CVE-2022-38096: There is a NULL pointer vulnerability in vmwgfx driver
A NULL pointer dereference issue was found in the Linux kernel's vmwgfx driver in vmwcmddxdefinequery. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.
Reference: https://bugzilla.openanolis.cn/showbug.cgi?id=2073
Other sources
A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
— Launchpad
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a NULL pointer dereference flaw in the vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component. By sending a specialy-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privilege to cause a denial of service condition.
— IBM
There is a NULL pointer vulnerability in vmwgfx driver
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-38096?
CVE-2022-38096 is a medium severity vulnerability due to the NULL pointer dereference in the vmwgfx driver.
How do I fix CVE-2022-38096?
To mitigate CVE-2022-38096, upgrade to the patched versions of the Linux kernel and ensure the vmwgfx driver is updated.
Which products are affected by CVE-2022-38096?
CVE-2022-38096 affects the Linux kernel versions from 4.20 and IBM QRadar SIEM versions up to 7.5.0 UP8 IF01.
What type of vulnerability is CVE-2022-38096?
CVE-2022-38096 is classified as a NULL pointer dereference vulnerability in the Linux kernel's vmwgfx driver.
Can CVE-2022-38096 be exploited remotely?
Exploitation of CVE-2022-38096 requires local access to the affected system, specifically to /dev/dri/card0 or similar devices.