CVE-2022-36402: There is an int overflow vulnerability in vmwgfx driver
An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
Other sources
An integer overflow was found in the Linux kernel's vmwgfx driver. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-36402 https://bugzilla.openanolis.cn/showbug.cgi?id=2072
— Red Hat
Linux Kernel could allow a remote authenticated attacker to gain elevated privileges on the system, caused by an integer overflow flaw in the vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in the GPU component. By persuading a victim to open a specially-crafted content, an authenticated attacker could exploit this vulnerability to gain elevated privileges and cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1 - Configuration
Prevent the vmwgfx kernel module from loading (blacklist or unload the module) to avoid exposing /dev/dri render/card devices to unprivileged users.
Linux kernel (vmwgfx driver) module_blacklist = blacklist vmwgfx - Configuration
Restrict access to /dev/dri/card0 and /dev/dri/renderD128 so unprivileged local users cannot open the device or issue ioctl() calls (e.g., adjust udev rules, file permissions, or group membership).
Device nodes /dev/dri/card0 and /dev/dri/renderD128 access_control = restrict to root or trusted group - Compensating control
Limit which accounts can log into or run code on systems using the vmwgfx driver (apply least-privilege, isolate affected hosts, and restrict access to trusted users) until the kernel is updated.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36402?
CVE-2022-36402 has a high severity rating due to its potential to allow local attackers to escalate privileges.
How do I fix CVE-2022-36402?
To fix CVE-2022-36402, update the affected software or kernel versions to the recommended patched versions.
Which products are affected by CVE-2022-36402?
CVE-2022-36402 affects IBM QRadar SIEM and specific versions of the Linux kernel.
Can CVE-2022-36402 be exploited remotely?
CVE-2022-36402 can only be exploited locally by authenticated users on the affected systems.
What type of vulnerability is CVE-2022-36402?
CVE-2022-36402 is classified as an integer overflow vulnerability within the vmwgfx driver of the Linux kernel.