Bug 2182429 (CVE-2023-22998)

Summary:	CVE-2023-22998 kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init()
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kyoshida, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.0-rc1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2115876, 2115880, 2182430, 2184625, 2184626, 2184627, 2184628
Bug Blocks:	2174321

Description Mauro Matteo Cascella 2023-03-28 15:55:13 UTC

NVD description: In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

Upstream commit:
https://github.com/torvalds/linux/commit/c24968734abfed81c8f93dc5f44a7b7a9aecadfa

Comment 1 Mauro Matteo Cascella 2023-03-28 15:55:41 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2182430]

Comment 8 Mauro Matteo Cascella 2023-04-02 16:01:00 UTC

Note that the above commit missed to zero out shmem->pages, fixed via this commit:
https://github.com/torvalds/linux/commit/64b88afbd92fbf434759d1896a7cf705e1c00e79

Comment 13 Justin M. Forbes 2023-04-06 16:10:17 UTC

This is fixed for Fedora with the 5.18.18 stable kernel updates.

Comment 16 Mauro Matteo Cascella 2023-07-10 07:58:57 UTC

This issue was fixed upstream in kernel version 6.0-rc1. The kernel packages as shipped in following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2023:2951

kernel-rt in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2023:2736

kernel in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2458

kernel-rt in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2148