All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vladis Dronov <vdronov@redhat.com>
To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
Date: Fri, 31 Mar 2017 06:47:30 -0400 (EDT)	[thread overview]
Message-ID: <736013744.9705201.1490957250099.JavaMail.zimbra@redhat.com> (raw)
In-Reply-To: <20170330102712.3123-1-vdronov@redhat.com>

This flaw was assigned an id CVE-2017-7346 by MITRE:

http://seclists.org/oss-sec/2017/q1/696

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Vladis Dronov" <vdronov@redhat.com>
To: "VMware Graphics" <linux-graphics-maintainer@vmware.com>, "Sinclair Yeh" <syeh@vmware.com>, "Thomas Hellstrom" <thellstrom@vmware.com>, "David Airlie" <airlied@linux.ie>, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: "Vladis Dronov" <vdronov@redhat.com>
Sent: Thursday, March 30, 2017 12:27:12 PM
Subject: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

WARNING: multiple messages have this Message-ID (diff)
From: Vladis Dronov <vdronov@redhat.com>
To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
Date: Fri, 31 Mar 2017 06:47:30 -0400 (EDT)	[thread overview]
Message-ID: <736013744.9705201.1490957250099.JavaMail.zimbra@redhat.com> (raw)
In-Reply-To: <20170330102712.3123-1-vdronov@redhat.com>

This flaw was assigned an id CVE-2017-7346 by MITRE:

http://seclists.org/oss-sec/2017/q1/696

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Vladis Dronov" <vdronov@redhat.com>
To: "VMware Graphics" <linux-graphics-maintainer@vmware.com>, "Sinclair Yeh" <syeh@vmware.com>, "Thomas Hellstrom" <thellstrom@vmware.com>, "David Airlie" <airlied@linux.ie>, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: "Vladis Dronov" <vdronov@redhat.com>
Sent: Thursday, March 30, 2017 12:27:12 PM
Subject: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431
Signed-off-by: Vladis Dronov <vdronov@redhat.com>

  reply	other threads:[~2017-03-31 10:47 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-30 10:27 [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Vladis Dronov
2017-03-30 10:27 ` Vladis Dronov
2017-03-31 10:47 ` Vladis Dronov [this message]
2017-03-31 10:47   ` Vladis Dronov
2017-03-31 15:07 ` Sinclair Yeh
2017-03-31 15:07   ` Sinclair Yeh
2017-04-04  9:43   ` Vladis Dronov
2017-04-04  9:43     ` Vladis Dronov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=736013744.9705201.1490957250099.JavaMail.zimbra@redhat.com \
    --to=vdronov@redhat.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.