Bug 2182429 (CVE-2023-22998) - CVE-2023-22998 kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init()
Summary: CVE-2023-22998 kernel: drm/virtio: improper return value check in virtio_gpu_...
Keywords:
Status: NEW
Alias: CVE-2023-22998
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2115876 2115880 2182430 2184625 2184626 2184627 2184628
Blocks: 2174321
TreeView+ depends on / blocked
 
Reported: 2023-03-28 15:55 UTC by Mauro Matteo Cascella
Modified: 2024-10-12 08:28 UTC (History)
44 users (show)

Fixed In Version: kernel 6.0-rc1
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-03-28 15:55:13 UTC
NVD description: In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

Upstream commit:
https://github.com/torvalds/linux/commit/c24968734abfed81c8f93dc5f44a7b7a9aecadfa

Comment 1 Mauro Matteo Cascella 2023-03-28 15:55:41 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2182430]

Comment 8 Mauro Matteo Cascella 2023-04-02 16:01:00 UTC
Note that the above commit missed to zero out shmem->pages, fixed via this commit:
https://github.com/torvalds/linux/commit/64b88afbd92fbf434759d1896a7cf705e1c00e79

Comment 13 Justin M. Forbes 2023-04-06 16:10:17 UTC
This is fixed for Fedora with the 5.18.18 stable kernel updates.

Comment 16 Mauro Matteo Cascella 2023-07-10 07:58:57 UTC
This issue was fixed upstream in kernel version 6.0-rc1. The kernel packages as shipped in following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2023:2951

kernel-rt in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2023:2736

kernel in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2458

kernel-rt in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2023:2148


Note You need to log in before you can comment on or make changes to this bug.