In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done after we are done dereferencing the object.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170494348850677282792594620964342773971",
"164164308297204162218135248073937826351",
"271021766280219334316156697274343058849",
"18231762042905771492846632349305158169",
"332001436132010744937013976494430206487",
"88161614035103183742584891154638148827",
"170494348850677282792594620964342773971",
"14305933792871695760750099527230926138",
"265537415334916326621625768561268098840",
"157634926822916122425677704930256769798",
"181400989658049512791473700964791181966",
"9961055764612876331906767750660121895"
]
},
"id": "CVE-2022-48899-0c460529",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1345.0,
"function_hash": "91997430600693568048610522906914096697"
},
"id": "CVE-2022-48899-1f60c310",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"261595852664792362975086906221483442037",
"282582467248600978113939613074600128145",
"4045635031488363003142059845266572308",
"121887396950478110457310229779058497145",
"194024729501646706729698616339437104954",
"244507428644734068670126112609066923711",
"254660488461004727373909090358651383334",
"91456898274405284299121434327907832305"
]
},
"id": "CVE-2022-48899-39b1e2e4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec87d06acfab2313ee82b2a689bf0c154e57ea",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"104124757130279596626044843432300727826",
"260317405459614610475315830640837069014",
"86050883490139135746296066652308571459",
"285932170987570346171017848175915708380",
"332001436132010744937013976494430206487",
"88161614035103183742584891154638148827"
]
},
"id": "CVE-2022-48899-511aa85d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170494348850677282792594620964342773971",
"164164308297204162218135248073937826351",
"271021766280219334316156697274343058849",
"18231762042905771492846632349305158169",
"332001436132010744937013976494430206487",
"88161614035103183742584891154638148827",
"170494348850677282792594620964342773971",
"14305933792871695760750099527230926138",
"265537415334916326621625768561268098840",
"157634926822916122425677704930256769798",
"181400989658049512791473700964791181966",
"9961055764612876331906767750660121895"
]
},
"id": "CVE-2022-48899-8680353c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1327.0,
"function_hash": "265160196971482965207278982080348700441"
},
"id": "CVE-2022-48899-9338299d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1345.0,
"function_hash": "91997430600693568048610522906914096697"
},
"id": "CVE-2022-48899-95a9e66d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1312.0,
"function_hash": "295073291569497111349311051997433988776"
},
"id": "CVE-2022-48899-9679a24d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68bcd063857075d2f9edfed6024387ac377923e2",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170494348850677282792594620964342773971",
"164164308297204162218135248073937826351",
"271021766280219334316156697274343058849",
"18231762042905771492846632349305158169",
"332001436132010744937013976494430206487",
"88161614035103183742584891154638148827",
"170494348850677282792594620964342773971",
"14305933792871695760750099527230926138",
"265537415334916326621625768561268098840",
"157634926822916122425677704930256769798",
"181400989658049512791473700964791181966",
"130413378317205551884800646658836067692"
]
},
"id": "CVE-2022-48899-bea7e411",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1300.0,
"function_hash": "271218589459590391608478480728654540624"
},
"id": "CVE-2022-48899-c9897a79",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_blob_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2366.0,
"function_hash": "277925783793582999496005654925539499723"
},
"id": "CVE-2022-48899-d1392931",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec87d06acfab2313ee82b2a689bf0c154e57ea",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170494348850677282792594620964342773971",
"164164308297204162218135248073937826351",
"271021766280219334316156697274343058849",
"18231762042905771492846632349305158169",
"332001436132010744937013976494430206487",
"88161614035103183742584891154638148827"
]
},
"id": "CVE-2022-48899-edd4f062",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68bcd063857075d2f9edfed6024387ac377923e2",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1300.0,
"function_hash": "271218589459590391608478480728654540624"
},
"id": "CVE-2022-48899-ef4a3ee2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_blob_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1312.0,
"function_hash": "295073291569497111349311051997433988776"
},
"id": "CVE-2022-48899-f8164cef",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_ioctl"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1300.0,
"function_hash": "271218589459590391608478480728654540624"
},
"id": "CVE-2022-48899-fcc496f6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e",
"target": {
"file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c",
"function": "virtio_gpu_resource_create_blob_ioctl"
}
}
]