Bug 1436798 (CVE-2017-7294)

Summary: CVE-2017-7294 kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
Product: [Other] Security Response Reporter: Vladis Dronov <vdronov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aquini, arm-mgr, bhu, dhoward, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mmilgram, nmurray, pholasek, plougher, rt-maint, rvrbovsk, slawomir, williams, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20170328,reported=20170328,source=researcher,cvss3=6.1/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H,cwe=CWE-20,rhel-5/kernel=notaffected,rhel-6/kernel=affected,rhel-7/kernel=affected,rhel-7/kernel-rt=affected,mrg-2/realtime-kernel=affected,rhelsa-7/arm-kernel=affected,fedora-all/kernel=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
An out-of-bounds write vulnerability was found in the Linux kernel's vmw_surface_define_ioctl() function, in the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:09:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1437894, 1436802, 1437432, 1437895, 1437896, 1437897, 1437898, 1437899, 1437900, 1437901, 1470097, 1695718, 1695787    
Bug Blocks: 1392508    

Description Vladis Dronov 2017-03-28 17:30:19 UTC
In was found that in the Linux kernel in vmw_surface_define_ioctl() function in 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file, a 'req->mip_levels[i]' are user-controlled values which are not checked for the upper limit and are used to calculate 'num_sizes' parameter. Both the 'num_sizes' and the array are 'uint32_t' so it is possible to make 'num_sizes' overflow. Later 'mip_levels[i]' are used as the loop count. This can lead an oob-write and/or kernel lock up. 

Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

References:

http://seclists.org/oss-sec/2017/q1/688

Proposed patch:

https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html

Comment 1 Vladis Dronov 2017-03-28 17:33:32 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1436802]

Comment 8 Vladis Dronov 2017-03-31 12:38:11 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code where the flaw was found is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Comment 9 errata-xmlrpc 2018-04-10 08:04:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676

Comment 10 errata-xmlrpc 2018-04-10 09:28:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062