Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2ac863719e518ae1a8f328849e64ea26a222f079 to < ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 50d177f90b63ea4138560e500d92be5e4c928186affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 6b4e70a428b5a11f56db94047b68e144529fe512affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 94b283341f9f3f0ed56a360533766377a01540e0affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 439cbbc1519547f9a7b483f0de33b556ebfec901affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 6948e570f54f2044dd4da444b10471373a047eebaffected2ac863719e518ae1a8f328849e64ea26a222f079 to < 4d54d11b49860686331c58a00f733b16a93edfc4affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 622d527decaac0eb65512acada935a0fdc1d0202affected2ac863719e518ae1a8f328849e64ea26a222f079 to < 4cf949c7fafe21e085a4ee386bb2dade9067316eaffected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected4.9.337 to ≤ 4.9.*unaffected4.14.303 to ≤ 4.14.*unaffected4.19.270 to ≤ 4.19.*unaffected5.4.229 to ≤ 5.4.*unaffected5.10.163 to ≤ 5.10.*unaffected5.15.87 to ≤ 5.15.*unaffected6.0.18 to ≤ 6.0.*unaffected6.1.4 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6 ↗
- https://git.kernel.org/stable/c/50d177f90b63ea4138560e500d92be5e4c928186 ↗
- https://git.kernel.org/stable/c/6b4e70a428b5a11f56db94047b68e144529fe512 ↗
- https://git.kernel.org/stable/c/94b283341f9f3f0ed56a360533766377a01540e0 ↗
- https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901 ↗
- https://git.kernel.org/stable/c/6948e570f54f2044dd4da444b10471373a047eeb ↗
- https://git.kernel.org/stable/c/4d54d11b49860686331c58a00f733b16a93edfc4 ↗
- https://git.kernel.org/stable/c/622d527decaac0eb65512acada935a0fdc1d0202 ↗
- https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316e ↗