In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix invalid reads in fence signaled events
Correctly set the length of the drm_event to the size of the structure that's actually used.
The length of the drmevent was set to the parent structure instead of to the drmvmweventfence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.
[
{
"signature_version": "v1",
"id": "CVE-2024-36960-1c579a59",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-3977fcb3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "102101422844412268584550878370063158728",
"length": 1061.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-48cfa53c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "102101422844412268584550878370063158728",
"length": 1061.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-49718bd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "102101422844412268584550878370063158728",
"length": 1061.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-595e1dc2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "288572624525679575866279334545641312039",
"length": 1063.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-600cabc2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5fd3af4a250dd0a2a558e07b43478748eb5d22",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "288572624525679575866279334545641312039",
"length": 1063.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-76e9e7f3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-8597ecf5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "288572624525679575866279334545641312039",
"length": 1063.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-93824c3f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-9e54626f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-b2776159",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "288572624525679575866279334545641312039",
"length": 1063.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-d3e6751b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-da627c08",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b5fd3af4a250dd0a2a558e07b43478748eb5d22",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-e3982718",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-f3c50b65",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b",
"signature_type": "Function",
"target": {
"function": "vmw_event_fence_action_create",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"function_hash": "288572624525679575866279334545641312039",
"length": 1063.0
}
},
{
"signature_version": "v1",
"id": "CVE-2024-36960-f7115820",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
]
}
}
]