CVE-2012-2384: Integer Overflow
Description of the problem: On 32-bit systems, a large args->numcliprects from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access.
References: http://www.openwall.com/lists/oss-security/2012/05/21/1
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=44afb3a04391a74309d16180d1e4f8386fdfa745
Other sources
Integer overflow in the i915gemdoexecbuffer function in drivers/gpu/drm/i915/i915gemexecbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2384?
CVE-2012-2384 is considered to be a medium severity vulnerability due to its potential for out-of-bounds access leading to memory corruption.
How do I fix CVE-2012-2384?
To fix CVE-2012-2384, update your Linux Kernel to a version higher than 3.3.4 where the vulnerability has been addressed.
Which versions of Linux Kernel are affected by CVE-2012-2384?
CVE-2012-2384 affects Linux Kernel versions up to and including 3.3.4.
What type of systems are impacted by CVE-2012-2384?
CVE-2012-2384 primarily impacts 32-bit systems.
What is the cause of CVE-2012-2384?
CVE-2012-2384 is caused by a large args->num_cliprects from userspace via ioctl that can overflow the allocation size.