CVE-2017-7294

Published: 28 March 2017

The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device.

From the Ubuntu Security Team

Li Qiang discovered that an integer overflow vulnerability existed in the Direct Rendering Manager (DRM) driver for VMWare devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7294
• https://bugzilla.redhat.com/show_bug.cgi?id=1436798
• https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html
• http://www.openwall.com/lists/oss-security/2017/03/29/1
• https://ubuntu.com/security/notices/USN-3293-1
• https://ubuntu.com/security/notices/USN-3291-1
• https://ubuntu.com/security/notices/USN-3291-2
• https://ubuntu.com/security/notices/USN-3291-3
• https://ubuntu.com/security/notices/USN-3342-1
• https://ubuntu.com/security/notices/USN-3343-1
• https://ubuntu.com/security/notices/USN-3343-2
• https://ubuntu.com/security/notices/USN-3342-2
• NVD
• Launchpad
• Debian