Bug 2133450 (CVE-2022-36280)

Summary:	CVE-2022-36280 kernel: vmwgfx: out-of-bounds write in vmw_kms_cursor_snoop
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, brdeoliv, chwhite, crwood, ddepaula, debarbos, dvlasenk, ezulian, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, kraxel, lgoncalv, linville, lzampier, masami256, mchehab, ndegraef, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.2-rc1	Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds memory write vulnerability was found in the Linux kernel's vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2115902, 2125474, 2133471, 2133472, 2133473, 2133474, 2133475
Bug Blocks:	2126143

Description Mauro Matteo Cascella 2022-10-10 13:44:14 UTC

An out-of-bounds memory write vulnerability was found in the Linux kernel's vmwgfx driver in vmw_kms_cursor_snoop, due to missing check of a memcpy length. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.

Reference:
https://bugzilla.openanolis.cn/show_bug.cgi?id=2071

Comment 1 Mauro Matteo Cascella 2022-10-10 15:16:37 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2133472]

Comment 11 Justin M. Forbes 2023-04-06 16:23:08 UTC

This was fixed for Fedora with the 6.0.18 stable kernel update.

Comment 13 Mauro Matteo Cascella 2023-06-15 18:00:06 UTC

Upstream fix:
https://github.com/torvalds/linux/commit/4cf949c7fafe21e085a4ee386bb2dade9067316e

Comment 14 Mauro Matteo Cascella 2023-06-15 18:02:01 UTC

This issue was fixed upstream in version 6.2-rc1. The kernel packages as shipped in the following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2458

kernel-rt in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2148