Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Smatch complains that returning a NULL here will lead to a NULL pointer
dereference in drm_mode_addfb2(). Return an error pointer instead.
A flaw was found in the Linux kernel's VirtIO GPU driver. A local user could exploit this flaw to cause a Denial of Service (DoS) by triggering a system crash. When user framebuffer creation encounters an error, the driver improperly returns a null value instead of an error code, resulting in a null pointer dereference in the display subsystem.
Отчет
A flaw of low impact was found in the Linux kernel's VirtIO GPU driver. When user framebuffer creation encounters an error, virtio_gpu_user_framebuffer_create() improperly returns NULL instead of an error pointer; because drm_mode_addfb2() checks the return value with IS_ERR(), it treats NULL as a valid framebuffer and later dereferences it, resulting in a NULL pointer dereference and a kernel crash. A local user with access to the DRM subsystem could trigger this failure path to cause a denial of service (system crash); there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. For the affected products (Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and the OpenShift Container Platform RHCOS kernels), the fix is deferred: this is a low severity, local-only denial of service with a simple, contained fix, so it will be addressed in a future scheduled kernel update rather than an immediate z-stream update. The residual risk is limited to a local denial of service by an attacker who already has local access and DRM device permissions. While the CVSS:3.1 score of 5.5 (Moderate) reflects high availability impact, Red Hat's overall impact rating is Low because exploitation requires local access and privileges, and the flaw provides no confidentiality, integrity, or privilege escalation impact.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
EPSS
5.5 Medium
CVSS3