Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to < eb20f418933bea53375843b27b4022c1810be63baffected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < fcd1e56e7816b31a1050ccc67df722b20f6bb15daffected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < a4a37080a5ac777b59306cfcdf854cc05d7604d4affected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < 036e16ada95389bdc30f41068af04c1d0872fad0affected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7affected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6affected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < 9759da60e38d7b9db44dc92713e4e0391883d221affected4e4ddd47774313accc86b233d6ca2c6a9037a671 to < f4f1db96bfd68b81053693ba53405b6f510ac16caffected
Linux Linux
Default version status: affected
2.6.33affected0 to < 2.6.33unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b ↗
- https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d ↗
- https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4 ↗
- https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0 ↗
- https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7 ↗
- https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6 ↗
- https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221 ↗
- https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c ↗