In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy has succeeded.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-09de0377",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vmw_fence_event_ioctl",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"digest": {
"function_hash": "30860537817470133912543821291419534698",
"length": 1424.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-229b2ab7",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vmw_execbuf_process",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
},
"digest": {
"function_hash": "196223619825923057038885380458634735719",
"length": 4879.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-3c1acec4",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vmw_kms_helper_buffer_finish",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"
},
"digest": {
"function_hash": "276771357433634537331662516529241502085",
"length": 426.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-45f080ce",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vmw_execbuf_copy_fence_user",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
},
"digest": {
"function_hash": "324821028146700120688056443673544608548",
"length": 861.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-4ad48b1a",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"
},
"digest": {
"line_hashes": [
"192803166294407843540619709630415853442",
"11015832587194791636720030304465836112",
"135332326658543865660959160984235447273",
"222333738978743066990602803843494470665"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-53b32f4e",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
},
"digest": {
"line_hashes": [
"171823706273444294788313458964035500092",
"248827478862896300848671380743239687905",
"229153070911317684991108437866314451966",
"170233072040565158791111884813734479275",
"157856859553697195748664887699008530296",
"126473971311352236891299869073419540836",
"65899791715696289868753766017029982845",
"134377543355494802127270517529802780409",
"80006179933305689720311750724315039957",
"260116815322800655256643132818538600738",
"251558327954635165798834135955237813511",
"108833167354270590979986351929795948152",
"55780024402151537389444255208875254340",
"315448820024193434162901977644031399478",
"316263280581411751016955379948468689340",
"337483725624042218634683576133247071107",
"60547649229989505596495031398253448669",
"77399790567705675238116156592939742532",
"328281978427944298236085552163817912304",
"273837625091961654149689847439867123747",
"122019400724324123375640210169061074686",
"82772965084949668257730933898815250850",
"218115619550638015729344943234631614122",
"55425062840045615747303185239140973552",
"254898965300996184473287122988693147030",
"117044619932630407101340547883523257147",
"263108102149615777136271826733160412678",
"100914717187965379551360499116742108473",
"171648862225052200538205292815840695853",
"17809887814068595460308471254374372298",
"192711777332491960021766234565092805248",
"158605130451068493603457227252966993855",
"70180099351764365825692697985636039791",
"14628414007055311848409627808659284256",
"140399491872295533256174622422668219298",
"8123805526437474039693907475491338672",
"186318144925115438460025705850854351824",
"255286504497315383982767452004595795144",
"83990623525234399299546803602202526332",
"279950777774505689423319200251122046296",
"196821658944067469807682304283409654732",
"335315009756152969641502816337506163789",
"173037575600472484324057620015172376766",
"175300775631932521407800666009550478479",
"230980410587655764577542302914633630495",
"116743926610250655803610093446288894967"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-69d73a33",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"digest": {
"line_hashes": [
"87706378272752051407218268047468342497",
"269537118407127054528523308471431376139",
"77892218113255902298418012719276977712",
"85799959512851005001397664433075634740"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516",
"id": "CVE-2022-48771-a60428e8",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h"
},
"digest": {
"line_hashes": [
"327356423874068994657886449202112375733",
"198530050478604672667351540774906530138",
"328296491391609040263494673468562176477",
"261487792823826159289760460033616956213",
"95742131442178283916732486842002643224",
"288769463668061253856715584018878666671",
"201845551549556431514520445664238470640",
"39703825151272769477868859713462879814",
"36183792610835316376423948685355114286",
"209263925405977802941564258275447423543",
"149379710274683423896319532471920643495",
"186638081430873276391757877891671097538"
],
"threshold": 0.9
}
}
]