Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8b7de6aa84682a3396544fd88cd457f95484573a to < 2f527e3efd37c7c5e85e8aa86308856b619fa59faffected8b7de6aa84682a3396544fd88cd457f95484573a to < cef0962f2d3e5fd0660c8efb72321083a1b531a9affected8b7de6aa84682a3396544fd88cd457f95484573a to < 3cd682357c6167f636aec8ac0efaa8ba61144d36affected8b7de6aa84682a3396544fd88cd457f95484573a to < b7bab33c4623c66e3398d5253870d4e88c52dfc0affected8b7de6aa84682a3396544fd88cd457f95484573a to < 0dbfc73670b357456196130551e586345ca48e1baffected8b7de6aa84682a3396544fd88cd457f95484573a to < 7b5fd3af4a250dd0a2a558e07b43478748eb5d22affected8b7de6aa84682a3396544fd88cd457f95484573a to < deab66596dfad14f1c54eeefdb72428340d72a77affected8b7de6aa84682a3396544fd88cd457f95484573a to < a37ef7613c00f2d72c8fc08bd83fb6cc76926c8caffected
Linux Linux
Default version status: affected
3.4affected0 to < 3.4unaffected4.19.314 to ≤ 4.19.*unaffected5.4.276 to ≤ 5.4.*unaffected5.10.217 to ≤ 5.10.*unaffected5.15.159 to ≤ 5.15.*unaffected6.1.91 to ≤ 6.1.*unaffected6.6.31 to ≤ 6.6.*unaffected6.8.10 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f ↗
- https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9 ↗
- https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36 ↗
- https://git.kernel.org/stable/c/b7bab33c4623c66e3398d5253870d4e88c52dfc0 ↗
- https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1b ↗
- https://git.kernel.org/stable/c/7b5fd3af4a250dd0a2a558e07b43478748eb5d22 ↗
- https://git.kernel.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77 ↗
- https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html ↗