Executive brief
VMware's vmwgfx graphics driver in the Linux kernel contains a buffer overflow vulnerability in cursor rendering. An attacker can exploit invalid DMA surface copy operations to overflow a memory buffer, potentially causing the system to crash or execute arbitrary code with elevated privileges.
Technical details
The vulnerability exists in the vmw_kms_cursor_snoop() function in drivers/gpu/drm/vmwgfx/vmwgfx_kms.c. Invalid userspace DMA surface copies lack proper validation of copy box dimensions, allowing the memcpy operation to overflow the snooped cursor image buffer. The root cause is missing bounds checking on the width (box->w) and height (box->h) fields of the copy operation, which are limited to a maximum of 64x64 pixels. The attack requires the ability to issue DMA commands via the VMware graphics device, typically requiring local access or guest-to-host escalation in a virtualized environment. The fix adds explicit validation: box->w > 64 || box->h > 64 triggers an error condition. Patches are available in Linux kernel versions 3.2 and later through the stable kernel trees.
Affected products
- Linux Linux kernel 3.2 to 6.9 and earlier (vmwgfx driver component)
Timeline
- 2022-10-25: disclosed
- 2023-01-14: patched