The vmwgbsurfacedefineioctl function (accessible via DRMIOCTLVMWGBSURFACECREATE) in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.11.4 defines a backuphandle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backuphandle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9605.json"
[
{
"id": "CVE-2017-9605-47067b32",
"target": {
"function": "vmw_gb_surface_define_ioctl",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@07678eca2cf9c9a18584e546c2b2a0d0c9a3150c",
"digest": {
"function_hash": "169846884098310256507054018543723881042",
"length": 2548.0
},
"signature_type": "Function"
},
{
"id": "CVE-2017-9605-ccd4edcc",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@07678eca2cf9c9a18584e546c2b2a0d0c9a3150c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"179562898126735187812055447001050734765",
"205825067097267095474781661855914007689",
"257460105391541290105609805240291627039",
"32417831189459502478762284289527038483",
"117604768096401537428625120896249824543",
"169845912257602232308625412494424000365",
"192140911231071839360626527409090992327",
"75541335104715698089134146122202848271",
"220535614453772992236200803050353030841",
"321033495242350811425143109499078156156",
"23398495749472544204592372055023249296",
"85604011841392089984281295162211526201",
"69688529041947737160500925470937360732"
]
},
"signature_type": "Line"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9605.json"
[
{
"id": "CVE-2017-9605-a9e04de5",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/07678eca2cf9c9a18584e546c2b2a0d0c9a3150c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"179562898126735187812055447001050734765",
"205825067097267095474781661855914007689",
"257460105391541290105609805240291627039",
"32417831189459502478762284289527038483",
"117604768096401537428625120896249824543",
"169845912257602232308625412494424000365",
"192140911231071839360626527409090992327",
"75541335104715698089134146122202848271",
"220535614453772992236200803050353030841",
"321033495242350811425143109499078156156",
"23398495749472544204592372055023249296",
"85604011841392089984281295162211526201",
"69688529041947737160500925470937360732"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2017-9605-ccc19ac3",
"target": {
"function": "vmw_gb_surface_define_ioctl",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/07678eca2cf9c9a18584e546c2b2a0d0c9a3150c",
"digest": {
"function_hash": "169846884098310256507054018543723881042",
"length": 2548.0
},
"signature_type": "Function"
}
]