Executive brief
A security vulnerability has been identified in the Linux kernel's VMware graphics driver (vmwgfx), which is used to manage video hardware in virtualized environments. A local user with standard access to the system could exploit this flaw to crash the operating system, leading to a total denial of service. This could disrupt business operations and impact the availability of services running on affected virtual machines or industrial controllers.
Technical details
A NULL pointer dereference vulnerability exists in the vmwgfx driver within the Linux kernel, specifically in the 'vmw_cmd_dx_define_query' function in 'drivers/gpu/vmxgfx/vmxgfx_execbuf.c'. The issue occurs because 'ctx_node->ctx' can be a NULL pointer when uninitialized. A local attacker with access to the '/dev/dri/renderD128' (or similar) device file can trigger this flaw via crafted ioctl() calls. Successful exploitation results in a kernel panic (Denial of Service) and has been reported to potentially allow for privilege escalation. Patches have been merged into various distributions including Anolis OS and Debian LTS.
Affected products
- Linux Linux Kernel 4.20 to 5.13.0-53
- OpenAnolis Anolis OS 8.6
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions
Timeline
- 2022-09-06: disclosed: Vulnerability reported to OpenAnolis bug tracker
- 2022-09-09: advisory: NVD published CVE-2022-38096
- 2024-04-18: patched: Fix merged in Anolis OS kernel
- 2024-06-25: patched: Debian LTS released security update DLA-3842-1