oss-security - CVE-2022-22942: Linux kernel: wrong file descriptor handling in the vmwgfx driver

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <0f115734-5e21-8fa9-7e96-f8636788a0bc@grsecurity.net>
Date: Thu, 27 Jan 2022 21:00:19 +0100
From: Mathias Krause <minipli@...ecurity.net>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Cc: Zack Rusin <zackr@...are.com>
Subject: CVE-2022-22942: Linux kernel: wrong file descriptor handling in the
 vmwgfx driver

Hi!

A vulnerability was found in the vmwgfx driver that allows unprivileged
users to gain access to files opened by other processes on the system
through a dangling 'file' pointer.

Exploiting this vulnerability requires an attacker to have access to
either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an
ioctl() on the resulting file descriptor.

Linux kernels making use of the vmwgfx driver and containing commit
c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
are affected, which is v4.14+.

If the vmwgfx driver isn't loaded, your system isn't affected.

Systems using the VMWare graphics card emulated by QEMU (-vga vmware)
aren't affected either, as these lack a required feature that makes the
driver fail to load.

Attached are patches as have been sent to linux-distros on Jan. 21st.
They're against mainline Linux (0001-*.patch) or backports for all
affected kernels (backport-*.patch) respectively. They should soon be
merged into the corresponding Linux kernel trees.

CVE-2022-22942 was allocated for this issue.

Thanks,
Mathias
View attachment "backport-5.16-drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch" of type "text/x-patch" (5567 bytes)

View attachment "backport-4.19-drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch" of type "text/x-patch" (5616 bytes)

View attachment "0001-drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch" of type "text/x-patch" (5509 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (666 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.