Improper locking in Linux kernel drm vmwgfx driver

1) Improper locking

EUVDB-ID: #VU96358

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48887

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vmw_execbuf_rcache_update(), vmw_execbuf_res_noref_val_add(), vmw_view_res_val_add(), vmw_resource_context_res_add(), vmw_cmd_res_check(), vmw_translate_mob_ptr(), vmw_translate_guest_ptr(), vmw_cmd_set_shader(), vmw_cmd_dx_set_shader(), vmw_cmd_dx_bind_shader(), vmw_cmd_dx_bind_streamoutput(), vmw_cmd_dx_set_streamoutput() and vmw_execbuf_tie_context() functions in drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c, within the vmw_user_bo_lookup() function in drivers/gpu/drm/vmwgfx/vmwgfx_bo.c, within the ttm_base_object_unref() and ttm_base_object_lookup() functions in drivers/gpu/drm/vmwgfx/ttm_object.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1 - 6.2 rc7

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:6.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc1:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc3:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc7:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.6:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a
https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.7
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.