Bug 2133451 (CVE-2022-36402) - CVE-2022-36402 kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c
Summary: CVE-2022-36402 kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c
Keywords:
Status: NEW
Alias: CVE-2022-36402
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2133477 2133478 2133479 2133480 2133481
Blocks: 2126143
TreeView+ depends on / blocked
 
Reported: 2022-10-10 13:49 UTC by Mauro Matteo Cascella
Modified: 2024-04-17 19:05 UTC (History)
55 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An integer overflow was found in the Linux kernel's vmwgfx driver. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, and able to issue an ioctl() on the resulting file descriptor to crash the system, causing a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:0610 0 None None None 2024-01-30 14:48:26 UTC
Red Hat Product Errata RHBA-2024:0611 0 None None None 2024-01-30 14:52:57 UTC
Red Hat Product Errata RHSA-2024:0461 0 None None None 2024-01-24 16:28:35 UTC
Red Hat Product Errata RHSA-2024:0930 0 None None None 2024-02-21 00:26:51 UTC
Red Hat Product Errata RHSA-2024:1404 0 None None None 2024-03-19 17:26:39 UTC

Description Mauro Matteo Cascella 2022-10-10 13:49:03 UTC 
An integer overflow was found in the Linux kernel's vmwgfx driver. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-36402
https://bugzilla.openanolis.cn/show_bug.cgi?id=2072
Comment 1 Mauro Matteo Cascella 2022-10-10 15:19:04 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2133478]
Comment 26 Mauro Matteo Cascella 2024-01-15 09:57:15 UTC 
Upstream patch:
https://lore.kernel.org/lkml/169297981236.24147.14742169892084120200.pr-tracker-bot@kernel.org/T/
Comment 27 Mauro Matteo Cascella 2024-01-15 09:59:15 UTC 
This CVE was fixed upstream in kernel version 6.5. The kernel packages as shipped in Red Hat Enterprise Linux 8 were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2024:0113

kernel-rt in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2024:0134
Comment 28 errata-xmlrpc 2024-01-24 16:28:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0461 https://access.redhat.com/errata/RHSA-2024:0461
Comment 30 errata-xmlrpc 2024-02-21 00:26:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0930 https://access.redhat.com/errata/RHSA-2024:0930
Comment 36 errata-xmlrpc 2024-03-19 17:26:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404
Note You need to log in before you can comment on or make changes to this bug.