CVE-2024-50134: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
In the Linux kernel, the following vulnerability has been resolved:
drm/vboxvideo: Replace fake VLA at end of vbvamousepointershape with real VLA
Replace the fake VLA at end of the vbvamousepointershape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning:
[ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmibase.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmibase.c:154 hgsmiupdatepointershape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmiupdatepointershape [vboxvideo] [ 13.320184] vboxcursoratomicupdate [vboxvideo]
Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50134?
CVE-2024-50134 has a high severity rating due to its potential impact on memory handling within the Linux kernel.
How do I fix CVE-2024-50134?
To fix CVE-2024-50134, update your Linux kernel to a version beyond 5.15.170 or within the safe ranges specified in the advisory.
Which versions of the Linux kernel are affected by CVE-2024-50134?
CVE-2024-50134 affects Linux kernel versions from 5.15 up to but not including 6.1.115, from 5.16 to 6.2, from 6.7 to 6.11.6, and specifically version 6.12-rc1.
What is the nature of the vulnerability in CVE-2024-50134?
CVE-2024-50134 involves a memory copy error due to a fake variable length array being used at the end of the vbva_mouse_pointer_shape.
Who discovered CVE-2024-50134?
CVE-2024-50134 was identified by Linux kernel developers as part of routine security assessments.