In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1968.0, "function_hash": "146305248845746760745566716219041924274" }, "id": "CVE-2022-50440-1021b248", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@622d527decaac0eb65512acada935a0fdc1d0202" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "14000898375087023703678858502648179488", "30079678729647059180797627935320990993", "205445965142094307271734308084246681479" ], "threshold": 0.9 }, "id": "CVE-2022-50440-215ce9b6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6948e570f54f2044dd4da444b10471373a047eeb" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1967.0, "function_hash": "257237933845321776166130397566661761625" }, "id": "CVE-2022-50440-28c5f911", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b283341f9f3f0ed56a360533766377a01540e0" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1968.0, "function_hash": "146305248845746760745566716219041924274" }, "id": "CVE-2022-50440-423471af", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6948e570f54f2044dd4da444b10471373a047eeb" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "14000898375087023703678858502648179488", "30079678729647059180797627935320990993", "205445965142094307271734308084246681479" ], "threshold": 0.9 }, "id": "CVE-2022-50440-4e6ae428", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d54d11b49860686331c58a00f733b16a93edfc4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1967.0, "function_hash": "257237933845321776166130397566661761625" }, "id": "CVE-2022-50440-58f71fb8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50d177f90b63ea4138560e500d92be5e4c928186" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1968.0, "function_hash": "146305248845746760745566716219041924274" }, "id": "CVE-2022-50440-77f2274c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d54d11b49860686331c58a00f733b16a93edfc4" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "14000898375087023703678858502648179488", "30079678729647059180797627935320990993", "205445965142094307271734308084246681479" ], "threshold": 0.9 }, "id": "CVE-2022-50440-85162e00", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@439cbbc1519547f9a7b483f0de33b556ebfec901" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "14000898375087023703678858502648179488", "30079678729647059180797627935320990993", "205445965142094307271734308084246681479" ], "threshold": 0.9 }, "id": "CVE-2022-50440-89b16e89", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cf949c7fafe21e085a4ee386bb2dade9067316e" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "73143842586085486573853191047618837663", "13478860701705950482887085043385812212", "112165738285278276259897056648334408383" ], "threshold": 0.9 }, "id": "CVE-2022-50440-9369e82d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50d177f90b63ea4138560e500d92be5e4c928186" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1968.0, "function_hash": "146305248845746760745566716219041924274" }, "id": "CVE-2022-50440-af706b6e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cf949c7fafe21e085a4ee386bb2dade9067316e" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "14000898375087023703678858502648179488", "30079678729647059180797627935320990993", "205445965142094307271734308084246681479" ], "threshold": 0.9 }, "id": "CVE-2022-50440-b04e1036", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@622d527decaac0eb65512acada935a0fdc1d0202" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1967.0, "function_hash": "257237933845321776166130397566661761625" }, "id": "CVE-2022-50440-d318e3b3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4e70a428b5a11f56db94047b68e144529fe512" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c", "function": "vmw_kms_cursor_snoop" }, "signature_version": "v1", "digest": { "length": 1968.0, "function_hash": "146305248845746760745566716219041924274" }, "id": "CVE-2022-50440-e2e57385", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@439cbbc1519547f9a7b483f0de33b556ebfec901" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "73143842586085486573853191047618837663", "13478860701705950482887085043385812212", "112165738285278276259897056648334408383" ], "threshold": 0.9 }, "id": "CVE-2022-50440-e4f7a471", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b283341f9f3f0ed56a360533766377a01540e0" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "167027837590520630163154694970864779179", "73143842586085486573853191047618837663", "13478860701705950482887085043385812212", "112165738285278276259897056648334408383" ], "threshold": 0.9 }, "id": "CVE-2022-50440-f732fd33", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4e70a428b5a11f56db94047b68e144529fe512" } ] }