Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7a73ba7469cbea631050094fd14f73acebb97cf9 to < b89ca4bba820f79dde52af15ee139fe6e8bbc314affected7a73ba7469cbea631050094fd14f73acebb97cf9 to < bef30317fcb4c838a37bceb2fc76256eb6b975c1affected7a73ba7469cbea631050094fd14f73acebb97cf9 to < 112c6ff29a56f3a22db4d5af869697aa07035ad6affected7a73ba7469cbea631050094fd14f73acebb97cf9 to < 2666cddf0dd218aa9bd1f99db688d1b532eac21aaffected7a73ba7469cbea631050094fd14f73acebb97cf9 to < fc0c02f510e41650df3479f96e257acf87d8a20aaffected7a73ba7469cbea631050094fd14f73acebb97cf9 to < dc0be7662b7b0ce28cb5eea864737793ed7b9e70affected7a73ba7469cbea631050094fd14f73acebb97cf9 to < c77cf8edae2bd3a1599115301cc7c98d0c78e731affected7a73ba7469cbea631050094fd14f73acebb97cf9 to < 85891d174707d8bddcec7a888fb4e1d17def34f3affected
Linux Linux
Default version status: affected
2.6.33affected0 to < 2.6.33unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314 ↗
- https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1 ↗
- https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6 ↗
- https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a ↗
- https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a ↗
- https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70 ↗
- https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731 ↗
- https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3 ↗