In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/vmwgfx: validate DRAW_PRIMITIVES header size before division<\/p>\n
vmw_cmd_draw() computes<\/p>\n
\tmaxnum = (header->size – sizeof(cmd->body)) \/ sizeof(*decl);<\/p>\n
where header->size is u32 and is taken straight from the user-supplied
\ncommand stream. When header->size is less than sizeof(cmd->body) the
\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.
\nAny user-controlled cmd->body.numVertexDecls then passes the bound and
\nthe loop dereferences decl[i] far past the end of the kernel command
\nbounce buffer, producing an out-of-bounds read of kernel memory.<\/p>\n
Reject undersized headers up front.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/vmwgfx: validate DRAW_PRIMITIVES header size before division<\/p>\n
vmw_cmd_draw() computes<\/p>\n
\tmaxnum = (header->size – sizeof(cmd->bo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8708","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}