In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done after we are done dereferencing the object.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-0c460529", "digest": { "line_hashes": [ "170494348850677282792594620964342773971", "164164308297204162218135248073937826351", "271021766280219334316156697274343058849", "18231762042905771492846632349305158169", "332001436132010744937013976494430206487", "88161614035103183742584891154638148827", "170494348850677282792594620964342773971", "14305933792871695760750099527230926138", "265537415334916326621625768561268098840", "157634926822916122425677704930256769798", "181400989658049512791473700964791181966", "9961055764612876331906767750660121895" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-1f60c310", "digest": { "length": 1345.0, "function_hash": "91997430600693568048610522906914096697" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-39b1e2e4", "digest": { "line_hashes": [ "261595852664792362975086906221483442037", "282582467248600978113939613074600128145", "4045635031488363003142059845266572308", "121887396950478110457310229779058497145", "194024729501646706729698616339437104954", "244507428644734068670126112609066923711", "254660488461004727373909090358651383334", "91456898274405284299121434327907832305" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec87d06acfab2313ee82b2a689bf0c154e57ea" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-511aa85d", "digest": { "line_hashes": [ "104124757130279596626044843432300727826", "260317405459614610475315830640837069014", "86050883490139135746296066652308571459", "285932170987570346171017848175915708380", "332001436132010744937013976494430206487", "88161614035103183742584891154638148827" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-8680353c", "digest": { "line_hashes": [ "170494348850677282792594620964342773971", "164164308297204162218135248073937826351", "271021766280219334316156697274343058849", "18231762042905771492846632349305158169", "332001436132010744937013976494430206487", "88161614035103183742584891154638148827", "170494348850677282792594620964342773971", "14305933792871695760750099527230926138", "265537415334916326621625768561268098840", "157634926822916122425677704930256769798", "181400989658049512791473700964791181966", "9961055764612876331906767750660121895" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-9338299d", "digest": { "length": 1327.0, "function_hash": "265160196971482965207278982080348700441" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-95a9e66d", "digest": { "length": 1345.0, "function_hash": "91997430600693568048610522906914096697" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-9679a24d", "digest": { "length": 1312.0, "function_hash": "295073291569497111349311051997433988776" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68bcd063857075d2f9edfed6024387ac377923e2" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-bea7e411", "digest": { "line_hashes": [ "170494348850677282792594620964342773971", "164164308297204162218135248073937826351", "271021766280219334316156697274343058849", "18231762042905771492846632349305158169", "332001436132010744937013976494430206487", "88161614035103183742584891154638148827", "170494348850677282792594620964342773971", "14305933792871695760750099527230926138", "265537415334916326621625768561268098840", "157634926822916122425677704930256769798", "181400989658049512791473700964791181966", "130413378317205551884800646658836067692" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_blob_ioctl" }, "id": "CVE-2022-48899-c9897a79", "digest": { "length": 1300.0, "function_hash": "271218589459590391608478480728654540624" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adc48e5e408afbb01d261bd303fd9fbbbaa3e317" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-d1392931", "digest": { "length": 2366.0, "function_hash": "277925783793582999496005654925539499723" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19ec87d06acfab2313ee82b2a689bf0c154e57ea" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c" }, "id": "CVE-2022-48899-edd4f062", "digest": { "line_hashes": [ "170494348850677282792594620964342773971", "164164308297204162218135248073937826351", "271021766280219334316156697274343058849", "18231762042905771492846632349305158169", "332001436132010744937013976494430206487", "88161614035103183742584891154638148827" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68bcd063857075d2f9edfed6024387ac377923e2" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_blob_ioctl" }, "id": "CVE-2022-48899-ef4a3ee2", "digest": { "length": 1300.0, "function_hash": "271218589459590391608478480728654540624" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_ioctl" }, "id": "CVE-2022-48899-f8164cef", "digest": { "length": 1312.0, "function_hash": "295073291569497111349311051997433988776" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@011ecdbcd520c90c344b872ca6b4821f7783b2f8" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/gpu/drm/virtio/virtgpu_ioctl.c", "function": "virtio_gpu_resource_create_blob_ioctl" }, "id": "CVE-2022-48899-fcc496f6", "digest": { "length": 1300.0, "function_hash": "271218589459590391608478480728654540624" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52531258318ed59a2dc5a43df2eaf0eb1d65438e" } ] }