In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix invalid reads in fence signaled events
Correctly set the length of the drm_event to the size of the structure that's actually used.
The length of the drmevent was set to the parent structure instead of to the drmvmweventfence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-1c579a59"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f",
"digest": {
"length": 1061.0,
"function_hash": "102101422844412268584550878370063158728"
},
"id": "CVE-2024-36960-3977fcb3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9",
"digest": {
"length": 1061.0,
"function_hash": "102101422844412268584550878370063158728"
},
"id": "CVE-2024-36960-48cfa53c"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36",
"digest": {
"length": 1061.0,
"function_hash": "102101422844412268584550878370063158728"
},
"id": "CVE-2024-36960-49718bd1"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77",
"digest": {
"length": 1063.0,
"function_hash": "288572624525679575866279334545641312039"
},
"id": "CVE-2024-36960-595e1dc2"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cd682357c6167f636aec8ac0efaa8ba61144d36",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-76e9e7f3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0",
"digest": {
"length": 1063.0,
"function_hash": "288572624525679575866279334545641312039"
},
"id": "CVE-2024-36960-8597ecf5"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deab66596dfad14f1c54eeefdb72428340d72a77",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-93824c3f"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-9e54626f"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c",
"digest": {
"length": 1063.0,
"function_hash": "288572624525679575866279334545641312039"
},
"id": "CVE-2024-36960-b2776159"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0962f2d3e5fd0660c8efb72321083a1b531a9",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-d3e6751b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7bab33c4623c66e3398d5253870d4e88c52dfc0",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-e3982718"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
"function": "vmw_event_fence_action_create"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbfc73670b357456196130551e586345ca48e1b",
"digest": {
"length": 1063.0,
"function_hash": "288572624525679575866279334545641312039"
},
"id": "CVE-2024-36960-f3c50b65"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f527e3efd37c7c5e85e8aa86308856b619fa59f",
"digest": {
"line_hashes": [
"156469992375570708281474570427032823917",
"220346529114482318988401847615329282579",
"323514062507850776982400033007401148142",
"252255792744299403098565728921093533824"
],
"threshold": 0.9
},
"id": "CVE-2024-36960-f7115820"
}
]