The vc4getbcl function in drivers/gpu/drm/vc4/vc4gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain overflow detections, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a VC4SUBMIT_CL ioctl call.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5577.json"
[
{
"target": {
"file": "drivers/gpu/drm/vc4/vc4_gem.c"
},
"digest": {
"line_hashes": [
"339277242872281413744374585267397308395",
"159470008539620328499910400918158012292",
"283918755532963457877437693201044276825",
"122759023147889268258498555248262894254"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2017-5577-5c52921a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6b8ac63847bc2f958dd93c09edc941a0118992d9",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/gpu/drm/vc4/vc4_gem.c",
"function": "vc4_get_bcl"
},
"digest": {
"length": 2256.0,
"function_hash": "210100817235803630841250447316652785836"
},
"signature_type": "Function",
"id": "CVE-2017-5577-f5523672",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@6b8ac63847bc2f958dd93c09edc941a0118992d9",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5577.json"
[
{
"target": {
"file": "drivers/gpu/drm/vc4/vc4_gem.c"
},
"digest": {
"line_hashes": [
"339277242872281413744374585267397308395",
"159470008539620328499910400918158012292",
"283918755532963457877437693201044276825",
"122759023147889268258498555248262894254"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2017-5577-37d56606",
"source": "https://github.com/torvalds/linux/commit/6b8ac63847bc2f958dd93c09edc941a0118992d9",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/gpu/drm/vc4/vc4_gem.c",
"function": "vc4_get_bcl"
},
"digest": {
"length": 2256.0,
"function_hash": "210100817235803630841250447316652785836"
},
"signature_type": "Function",
"id": "CVE-2017-5577-50aca942",
"source": "https://github.com/torvalds/linux/commit/6b8ac63847bc2f958dd93c09edc941a0118992d9",
"deprecated": false,
"signature_version": "v1"
}
]