oss-security - Re: CVE-2022-22942: Linux kernel: wrong file descriptor handling in the vmwgfx driver

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <77daef92-54bb-4c5c-cea2-c489e46d9027@grsecurity.net>
Date: Thu, 27 Jan 2022 23:20:48 +0100
From: Mathias Krause <minipli@...ecurity.net>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE-2022-22942: Linux kernel: wrong file descriptor handling in
 the vmwgfx driver

Am 27.01.22 um 21:00 schrieb Mathias Krause:
> Exploiting this vulnerability requires an attacker to have access to
> either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an
> ioctl() on the resulting file descriptor.

Forgot to mention, as per linux-distros' list policy, an exploit for the
vulnerability will be provided in 7 days, as one has been shared with
the linux-distros before.

Meanwhile the patch was merged into Linux mainline:
https://git.kernel.org/linus/a0f90c881570

Thanks,
Mathias


Download attachment "OpenPGP_signature" of type "application/pgp-signature" (666 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.