Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against
its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is
near U64_MAX the unsigned addition wraps and the resulting tiny value
passes the check. The unbounded offset is then stored in
res->guest_memory_offset and forwarded to host SVGA shader-create
commands.
Use check_add_overflow() to detect the wrap and compare the resulting
endpoint against the buffer size.
A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmw_shader_define() function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.
Отчет
A flaw was found in the Linux kernel drm/vmwgfx driver, which Red Hat Product Security rates as IMPORTANT (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vmw_shader_define() function validates a user-supplied shader window against its backing buffer using an unsigned addition of size and offset. Because drm_vmw_shader_create_arg::offset is a 64-bit user-controlled value, an offset near U64_MAX causes the addition to wrap around, so the resulting small value incorrectly passes the bounds check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to the host SVGA shader-create commands. A local unprivileged attacker with access to the vmwgfx DRM device, such as within a guest virtual machine using VMware graphics, could exploit this integer overflow to cause memory corruption, potentially leading to privilege escalation or denial of service; successful exploitation is judged to require high attack complexity. Currently affected products include the Red Hat Enterprise Linux 8, 9, and 10 kernels (kernel and kernel-rt) and Red Hat In-Vehicle OS, for which fixes are being pursued. Several older update streams (RHEL 7 ELS, RHEL 8.4, 8.6, and 8.8 z streams, and RHEL 9.2.0.z) are not affected because the vulnerable code is not present in those kernels.
Меры по смягчению последствий
To mitigate this vulnerability, prevent the vmwgfx kernel module from loading if VMware virtual graphics acceleration is not needed:
- Create a configuration file to prevent the module from being loaded:
echo "install vmwgfx /bin/true" > /etc/modprobe.d/disable-vmwgfx.conf
- If the module is currently loaded, reboot the system for the change to take effect:
reboot
Warning: Disabling this module prevents VMware guest graphics acceleration and may impair graphical desktop environments running inside VMware virtual machines. A reboot is necessary if the driver is already active in memory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Under investigation | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 5 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:88477 | 23.10.2026 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:82806 | 14.10.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:82807 | 14.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:81552 | 13.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
drm/vmwgfx: use check_add_overflow for shader size+offset bound
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
EPSS
7 High
CVSS3