Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
668b206601c5f5063e03b76784a0d3024fa2b249 to < 1bbe7751f5ebac383405ef29a66622d65bd505d3affected668b206601c5f5063e03b76784a0d3024fa2b249 to < d3f44438aa805270aaead3b6840ccaea0f4c11f9affected668b206601c5f5063e03b76784a0d3024fa2b249 to < cfd163169af3be56eaef113c680ea251f0d09189affected668b206601c5f5063e03b76784a0d3024fa2b249 to < 5c725901908eb1e52a16fc0e2373cb761df42d21affected668b206601c5f5063e03b76784a0d3024fa2b249 to < 54d56d5b42d2e4c72ba6e365e9774da90698aa22affected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3 ↗
- https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9 ↗
- https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189 ↗
- https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21 ↗
- https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22 ↗