CVE-2012-0044: Integer Overflow
Integer overflow in the drmmodedirtyfbioctl function in drivers/gpu/drm/drmcrtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.
Other sources
There is a potential integer overflow in drmmodedirtyfbioctl() if userspace passes in a large numclips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption.
Reported-by: Haogang Chen <haogangchen> Signed-off-by: Xi Wang <xi.wang>
Upstream commit: http://git.kernel.org/linus/a5cd335165e31db9dbab636fd29895d41da55dd2
Acknowledgements:
Red Hat would like to thank Chen Haogang for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0044?
CVE-2012-0044 has a medium severity rating, as it can lead to local privilege escalation or denial of service.
How do I fix CVE-2012-0044?
To fix CVE-2012-0044, update the Linux kernel to version 3.1.5 or later.
Which systems are affected by CVE-2012-0044?
CVE-2012-0044 affects Linux kernel versions prior to 3.1.5, including Debian and Ubuntu 10.04.
Can CVE-2012-0044 be exploited remotely?
CVE-2012-0044 requires local access to exploit, so it cannot be exploited remotely.
What components are involved in CVE-2012-0044?
CVE-2012-0044 involves the Direct Rendering Manager (DRM) subsystem in the Linux kernel.