CVE-2017-7294: Integer Overflow
In was found that in the Linux kernel in vmwsurfacedefineioctl() function in 'drivers/gpu/drm/vmwgfx/vmwgfxsurface.c' file, a 'req->miplevels[i]' are user-controlled values which are not checked for the upper limit and are used to calculate 'numsizes' parameter. Both the 'numsizes' and the array are 'uint32t' so it is possible to make 'numsizes' overflow. Later 'miplevels[i]' are used as the loop count. This can lead an oob-write and/or kernel lock up.
Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
http://seclists.org/oss-sec/2017/q1/688
Proposed patch:
https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html
Other sources
The vmwsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD device.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is CVE-2017-7294?
CVE-2017-7294 is a vulnerability in the Linux kernel that allows local users to trigger an integer overflow and out-of-bounds write, causing a denial of service (system hang or crash).
How severe is CVE-2017-7294?
CVE-2017-7294 has a severity level of medium.
Which software versions are affected by CVE-2017-7294?
The affected software versions include Ubuntu Linux (4.11~), Linux Trusty (3.13.0-123.172), Linux Xenial (4.4.0-78.99), Linux Yakkety (4.8.0-58.63), and Linux Zesty (4.10.0-21.23).
How do I fix CVE-2017-7294?
To fix CVE-2017-7294, users should update to the appropriate patched versions of the Linux kernel.
Where can I find more information about CVE-2017-7294?
More information about CVE-2017-7294 can be found at the following references: http://seclists.org/oss-sec/2017/q1/688, https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1436802.