An out-of-bounds memory write vulnerability was found in the Linux kernel's vmwgfx driver in vmw_kms_cursor_snoop, due to missing check of a memcpy length. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2133472]
This was fixed for Fedora with the 6.0.18 stable kernel update.
This issue was fixed upstream in version 6.2-rc1. The kernel packages as shipped in the following Red Hat products were previously updated to a version that contains the fix via the following errata:
kernel in Red Hat Enterprise Linux 9
kernel-rt in Red Hat Enterprise Linux 9