In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: drm/vmwgfx: Devolver el valor correcto en las funciones vmw_translate_ptr Antes de las correcciones referenciadas, estas funciones utilizaban una función de búsqueda que devolvía un puntero. Esto fue cambiado a otra función de búsqueda que devolvía un código de error con el puntero convirtiéndose en un parámetro de salida. La ruta de error cuando la búsqueda fallaba no fue cambiada para reflejar este cambio y el código continuó devolviendo el PTR_ERR del puntero ahora no inicializado. Esto podría causar que las funciones vmw_translate_ptr devolvieran éxito cuando en realidad fallaron, causando accesos no inicializados y OOB adicionales.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 1.8
Impact Score: 5.9
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-908
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2905c37c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2905c2400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342601cc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd319eba100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2905c0900> | Operating System |
| linux | linux_kernel | 6.2 | <built-in method update of dict object at 0x7fd2905c1300> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd319eb8480> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd319eb8840> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd319eb9d00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2905c2ac0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd340890300> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2905c1000> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2d814a180> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |