CVE-2017-5576

Published: 6 February 2017

Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call.

From the Ubuntu Security Team

Murray McAllister discovered that an integer overflow existed in the VideoCore DRM driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

See lkml.org link for the proposed fix. As of 2017-01-25, the fix has
not been committed upstream.

Status

Severity score breakdown

References

• https://lkml.org/lkml/2017/1/17/761
• https://ubuntu.com/security/notices/USN-3359-1
• https://ubuntu.com/security/notices/USN-3361-1
• https://www.cve.org/CVERecord?id=CVE-2017-5576
• NVD
• Launchpad
• Debian