Bug 1462172 (CVE-2017-9605) - CVE-2017-9605 kernel: Uninitialized kernel memory leak in vmw_gb_surface_define_ioctl function
Summary: CVE-2017-9605 kernel: Uninitialized kernel memory leak in vmw_gb_surface_defi...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-9605
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1462173 1462817
Blocks: 1462174
TreeView+ depends on / blocked
 
Reported: 2017-06-16 11:27 UTC by Adam Mariš
Modified: 2021-02-17 02:01 UTC (History)
34 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.
Clone Of:
Environment:
Last Closed: 2017-06-19 15:40:47 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2017-06-16 11:27:48 UTC 
The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.

Discussion:

http://seclists.org/oss-sec/2017/q2/459

CVE-ID assignment:

http://seclists.org/oss-sec/2017/q2/468

Upstream patch:

https://github.com/torvalds/linux/commit/07678eca2cf9c9a18584e546c2b2a0d0c9a3150c
Comment 1 Adam Mariš 2017-06-16 11:28:55 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1462173]
Comment 2 Justin M. Forbes 2017-06-16 12:01:11 UTC 
In Fedora, this is fixed with the 4.11.5 stable update currently available across all releases.
Comment 5 Vladis Dronov 2017-06-19 15:40:47 UTC 
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code where the flaw was found is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Note You need to log in before you can comment on or make changes to this bug.