CVE-2017-7346: Input Validation
It was found that in the Linux kernel in vmwgbsurfacedefineioctl() function in 'drivers/gpu/drm/vmwgfx/vmwgfxsurface.c' file, a 'req->miplevels' is a user-controlled value which is later used as a loop count limit. This allows local unprivileged user to cause a denial of service by a kernel lockup via a crafted ioctl call for a '/dev/dri/renderD' device.
References:
http://seclists.org/oss-sec/2017/q1/696
Proposed patch:
https://lists.freedesktop.org/archives/dri-devel/2017-March/137429.html
http://marc.info/?l=linux-kernel&m=149086968410117&w=2
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf
Other sources
The vmwgbsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD device.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is CVE-2017-7346?
CVE-2017-7346 is a vulnerability that allows local users to cause a denial of service (system hang) in the Linux kernel.
How severe is CVE-2017-7346?
CVE-2017-7346 has a low severity.
Which Linux kernel versions are affected by CVE-2017-7346?
Linux kernel versions through 4.10.7 are affected by CVE-2017-7346.
How can I fix the CVE-2017-7346 vulnerability?
To fix the CVE-2017-7346 vulnerability, update your Linux kernel to version 4.12 or higher.
Where can I find more information about CVE-2017-7346?
You can find more information about CVE-2017-7346 at the following references: [Link 1](https://bugzilla.redhat.com/show_bug.cgi?id=1437431), [Link 2](https://lists.freedesktop.org/archives/dri-devel/2017-March/137429.html), [Link 3](http://www.securityfocus.com/bid/97257).