CVE-2017-7346

Published: 30 March 2017

The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.

From the Ubuntu Security Team

Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the Linux kernel did not properly validate some ioctl arguments. A local attacker could use this to cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7346
• http://marc.info/?l=linux-kernel&m=149086968410117&w=2
• https://bugzilla.redhat.com/show_bug.cgi?id=1437431
• https://lists.freedesktop.org/archives/dri-devel/2017-March/137429.html
• http://www.openwall.com/lists/oss-security/2017/03/29/1
• https://github.com/torvalds/linux/commit/ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf
• https://ubuntu.com/security/notices/USN-3358-1
• https://ubuntu.com/security/notices/USN-3359-1
• https://ubuntu.com/security/notices/USN-3360-1
• https://ubuntu.com/security/notices/USN-3360-2
• https://ubuntu.com/security/notices/USN-3364-1
• https://ubuntu.com/security/notices/USN-3364-2
• https://ubuntu.com/security/notices/USN-3364-3
• https://ubuntu.com/security/notices/USN-3371-1
• NVD
• Launchpad
• Debian