Is CVE-2022-38096 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-38096 being exploited in the wild.

How severe is CVE-2022-38096?

Medium severity, with a CVSS score of 6.3, published 9 September 2022.

Which products and versions are affected?

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

Is there a fix for CVE-2022-38096?

A patch was published on 2024-04-18: Fix merged in Anolis OS kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-38096 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2022-38096?

Check whether you run Linux Kernel, OpenAnolis Anolis OS or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-38096: Linux Kernel NULL pointer dereference in vmwgfx driver

CVE-2022-38096 · Severity: medium · CVSS 6.3 · Published 2022-09-09

A security vulnerability has been identified in the Linux kernel's VMware graphics driver (vmwgfx), which is used to manage video hardware in virtualized environments. A local user with standard access to the system could exploit this flaw to crash the operating system, leading to a total denial of service. This could disrupt business operations and impact the availability of services running on affected virtual machines or industrial controllers.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Vendors: Linux, Siemens.

Quick answers

Is CVE-2022-38096 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-38096 being exploited in the wild.
How severe is CVE-2022-38096?: Medium severity, with a CVSS score of 6.3, published 9 September 2022.
Which products and versions are affected?: Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.
Is there a fix for CVE-2022-38096?: A patch was published on 2024-04-18: Fix merged in Anolis OS kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-38096 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2022-38096?: Check whether you run Linux Kernel, OpenAnolis Anolis OS or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference vulnerability exists in the vmwgfx driver within the Linux kernel, specifically in the 'vmw_cmd_dx_define_query' function in 'drivers/gpu/vmxgfx/vmxgfx_execbuf.c'. The issue occurs because 'ctx_node->ctx' can be a NULL pointer when uninitialized. A local attacker with access to the '/dev/dri/renderD128' (or similar) device file can trigger this flaw via crafted ioctl() calls. Successful exploitation results in a kernel panic (Denial of Service) and has been reported to potentially allow for privilege escalation. Patches have been merged into various distributions including Anolis OS and Debian LTS.

Affected products

Linux Linux Kernel 4.20 to 5.13.0-53
OpenAnolis Anolis OS 8.6
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

Timeline

2022-09-06: disclosed: Vulnerability reported to OpenAnolis bug tracker
2022-09-09: advisory: NVD published CVE-2022-38096
2024-04-18: patched: Fix merged in Anolis OS kernel
2024-06-25: patched: Debian LTS released security update DLA-3842-1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.