CVE-2024-36960

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 8b7de6aa84682a3396544fd88cd457f95484573a < 2f527e3efd37c7c5e85e8aa86308856b619fa59f, >= 8b7de6aa84682a3396544fd88cd457f95484573a < cef0962f2d3e5fd0660c8efb72321083a1b531a9, >= 8b7de6aa84682a3396544fd88cd457f95484573a < 3cd682357c6167f636aec8ac0efaa8ba61144d36, >= 8b7de6aa84682a3396544fd88cd457f95484573a < b7bab33c4623c66e3398d5253870d4e88c52dfc0, >= 8b7de6aa84682a3396544fd88cd457f95484573a < 0dbfc73670b357456196130551e586345ca48e1b, >= 8b7de6aa84682a3396544fd88cd457f95484573a < 7b5fd3af4a250dd0a2a558e07b43478748eb5d22, >= 8b7de6aa84682a3396544fd88cd457f95484573a < deab66596dfad14f1c54eeefdb72428340d72a77, >= 8b7de6aa84682a3396544fd88cd457f95484573a < a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c, >= 3.4, >= 3.4 < 4.19.314, >= 4.20 < 5.4.276, >= 5.5 < 5.10.217, >= 5.11 < 5.15.159, >= 5.16 < 6.1.91, >= 6.2 < 6.6.31, >= 6.7 < 6.8.10, 6.9, 10.0

Fixed versions

4.19.314, 5.4.276, 5.10.217, 5.15.159, 6.1.91, 6.6.31, 6.8.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125