CVE-2024-50134
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.
How to fix
- linux linux_kernel5.15.170, 6.1.115, 6.6.59, 6.11.6 or later
- git.kernel.org/stable/c/34a422274b693507025a7db21519865d1862afcb
- git.kernel.org/stable/c/7458a6cdaebb3dc59af8578ee354fae78a154c4a
- git.kernel.org/stable/c/9eb32bd23bbcec44bcbef27b7f282b7a7f3d0391
- git.kernel.org/stable/c/d92b90f9a54d9300a6e883258e79f36dab53bfae
- git.kernel.org/stable/c/fae9dc12c61ce23cf29d09824a741b7b1ff8f01f
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 5.15.170, 5.16 ≤ v < 6.1.115, 6.2 ≤ v < 6.6.59, 6.7 ≤ v < 6.11.6, 6.12 | 5.15.170, 6.1.115, 6.6.59, 6.11.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.