Bug 2218195 (CVE-2023-33951, ZDI-23-707, ZDI-CAN-20110)

Summary: CVE-2023-33951 kernel: vmwgfx: race condition leading to information disclosure vulnerability
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, ndegraef, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ymankad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.4-rc1 Doc Type: If docs needed, set a value
Doc Text:
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2218197, 2218198, 2218199, 2218200    
Bug Blocks: 2218114    

Description Mauro Matteo Cascella 2023-06-28 12:16:22 UTC 
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of GEM objects. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to disclose information in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/
Comment 4 Mauro Matteo Cascella 2023-06-28 12:56:17 UTC 
Upstream fix:
https://github.com/torvalds/linux/commit/9ef8d83
Comment 6 errata-xmlrpc 2023-11-07 08:20:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583
Comment 7 errata-xmlrpc 2023-11-14 15:15:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6901 https://access.redhat.com/errata/RHSA-2023:6901
Comment 8 errata-xmlrpc 2023-11-14 15:21:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7077 https://access.redhat.com/errata/RHSA-2023:7077
Comment 11 errata-xmlrpc 2024-03-19 17:27:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404