Bug 2133451 (CVE-2022-36402)

Summary:	CVE-2022-36402 kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, brdeoliv, bskeggs, chwhite, ddepaula, debarbos, dvlasenk, ezulian, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, kraxel, ldu, lgoncalv, linville, lleshchi, lzampier, masami256, mchehab, ndegraef, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steve.beattie, steved, swood, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An integer overflow was found in the Linux kernel's vmwgfx driver. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, and able to issue an ioctl() on the resulting file descriptor to crash the system, causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2133477, 2133479, 2133480, 2133481, 2133478
Bug Blocks:	2126143

Description Mauro Matteo Cascella 2022-10-10 13:49:03 UTC

An integer overflow was found in the Linux kernel's vmwgfx driver. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-36402
https://bugzilla.openanolis.cn/show_bug.cgi?id=2072

Comment 1 Mauro Matteo Cascella 2022-10-10 15:19:04 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2133478]