NetSight
IP …
high7.8

CVE-2017-7294

The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain level…

Impact

The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.2 before 3.2.89
from 3.3 before 3.10.107
from 3.11 before 3.12.74
from 3.13 before 3.16.44
from 3.17 before 3.18.50
from 3.19 before 4.1.40

Weakness classification

CWE-190CWE-787

References