CVE-2022-36402: There is an int overflow vulnerability in vmwgfx driver
An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
Other sources
An integer overflow was found in the Linux kernel's vmwgfx driver. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-36402 https://bugzilla.openanolis.cn/showbug.cgi?id=2072
— Red Hat
Linux Kernel could allow a remote authenticated attacker to gain elevated privileges on the system, caused by an integer overflow flaw in the vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in the GPU component. By persuading a victim to open a specially-crafted content, an authenticated attacker could exploit this vulnerability to gain elevated privileges and cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36402?
CVE-2022-36402 has a high severity rating due to its potential to allow local attackers to escalate privileges.
How do I fix CVE-2022-36402?
To fix CVE-2022-36402, update the affected software or kernel versions to the recommended patched versions.
Which products are affected by CVE-2022-36402?
CVE-2022-36402 affects IBM QRadar SIEM and specific versions of the Linux kernel.
Can CVE-2022-36402 be exploited remotely?
CVE-2022-36402 can only be exploited locally by authenticated users on the affected systems.
What type of vulnerability is CVE-2022-36402?
CVE-2022-36402 is classified as an integer overflow vulnerability within the vmwgfx driver of the Linux kernel.