Executive brief
A vulnerability in the Linux kernel's VirtualBox video driver could allow a local user to cause a system crash. The issue stems from how the driver handles mouse pointer shapes, leading to memory errors that trigger kernel warnings or instability. This primarily affects systems running Linux as a guest operating system within VirtualBox.
Technical details
A field-spanning write vulnerability exists in the vboxvideo driver within the Linux kernel. The root cause is the use of a 'fake' Variable Length Array (VLA) defined as a fixed-size 4-byte array at the end of the vbva_mouse_pointer_shape structure. When hgsmi_update_pointer_shape performs a memcpy into this field, it exceeds the 4-byte boundary, triggering a 'detected field-spanning write' warning and potential memory corruption. An attacker with local access could exploit this to cause a denial of service (system crash). The fix involves replacing the fixed-size array with a proper C99 flexible array member.
Affected products
- Linux Linux Kernel up to 5.15.170, 5.16 to 6.1.115, 6.2 to 6.6.59, 6.7 to 6.11.6
Timeline
- 2024-11-05: disclosed
- 2024-11-05: advisory
- 2024-11-08: patched
References
- https://git.kernel.org/stable/c/02c86c5d5ef4bbba17d38859c74872825f536617
- https://git.kernel.org/stable/c/34a422274b693507025a7db21519865d1862afcb
- https://git.kernel.org/stable/c/7458a6cdaebb3dc59af8578ee354fae78a154c4a
- https://git.kernel.org/stable/c/75f828e944dacaac8870418461d3d48a1ecf2331
- https://git.kernel.org/stable/c/9eb32bd23bbcec44bcbef27b7f282b7a7f3d0391
- https://git.kernel.org/stable/c/d92b90f9a54d9300a6e883258e79f36dab53bfae
- https://git.kernel.org/stable/c/fae9dc12c61ce23cf29d09824a741b7b1ff8f01f