{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48887", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:06:23.290Z", "datePublished": "2024-08-21T06:10:19.073Z", "dateUpdated": "2026-08-05T08:52:48.345Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:48.345Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reachable only via local DRM ioctls (DRM_IOCTL_VMW_EXECBUF and related resource create/destroy) on the vmwgfx render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker controls both sides of the race by submitting command buffers from multiple threads and/or destroying shared user resources concurrently; the commit notes it was easy to trigger, with no conditions outside attacker control.\nPR:L - VMW_EXECBUF and resource ioctls are DRM_RENDER_ALLOW on a DRIVER_RENDER device, so any unprivileged local user who can open the render node can exercise the path without real root or init-namespace capabilities.\nUI:N - Exploitation uses only the attacker’s own ioctls on the DRM fd; no victim action such as mounting, opening a crafted file, or interacting with the attacker is required.\nS:U - Impact is use-after-free / memory corruption inside the guest kernel’s vmwgfx driver under the same OS security authority; this is not a VMware guest-to-host escape or other cross-boundary breakout.\nC:H - Buggy RCU noref lookups return TTM/user-resource pointers without taking a reference while a concurrent unref can tear down and free associated objects, yielding a heap UAF that can be leveraged for arbitrary kernel reads.\nI:H - The same UAF of shared DRM/TTM resource objects enables heap spray/reuse and control-flow hijacking primitives, consistent with treating exploitable use-after-free as High integrity impact.\nA:H - The race reliably produces kernel oopses (IGT vmwgfx execution_buffer stress test and apps using shared resources), which is full availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vmwgfx/ttm_object.c", "drivers/gpu/drm/vmwgfx/ttm_object.h", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h", "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c", "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c" ], "versions": [ { "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e", "lessThan": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a", "status": "affected", "versionType": "git" }, { "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e", "lessThan": "a309c7194e8a2f8bd4539b9449917913f6c2cd50", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vmwgfx/ttm_object.c", "drivers/gpu/drm/vmwgfx/ttm_object.h", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h", "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c", "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.7", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a" }, { "url": "https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50" } ], "title": "drm/vmwgfx: Remove rcu locks from user resources", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48887", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:04:35.491654Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:32:51.743Z" } } ] } }