In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix invalid reads in fence signaled events
Correctly set the length of the drm_event to the size of the structure that's actually used.
The length of the drmevent was set to the parent structure instead of to the drmvmweventfence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.
[ { "signature_type": "Line", "id": "CVE-2024-36960-1c579a59", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-3977fcb3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "102101422844412268584550878370063158728", "length": 1061.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-48cfa53c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "102101422844412268584550878370063158728", "length": 1061.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-49718bd1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "102101422844412268584550878370063158728", "length": 1061.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-595e1dc2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "288572624525679575866279334545641312039", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-600cabc2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5fd3af4a250dd0a2a558e07b43478748eb5d22", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "288572624525679575866279334545641312039", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-76e9e7f3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-8597ecf5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "288572624525679575866279334545641312039", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-93824c3f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-9e54626f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-b2776159", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "288572624525679575866279334545641312039", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-d3e6751b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-da627c08", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5fd3af4a250dd0a2a558e07b43478748eb5d22", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-e3982718", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-36960-f3c50b65", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b", "signature_version": "v1", "target": { "function": "vmw_event_fence_action_create", "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "function_hash": "288572624525679575866279334545641312039", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-36960-f7115820", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "156469992375570708281474570427032823917", "220346529114482318988401847615329282579", "323514062507850776982400033007401148142", "252255792744299403098565728921093533824" ] }, "deprecated": false } ]