CVE-2022-48887

CVE-2022-48887

High · published August 21, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Remove rcu locks from user resources

User resource lookups used rcu to avoid two extra atomics. Unfortunately

the rcu paths were buggy and it was easy to make the driver crash by

submitting command buffers from two different threads. Because the

lookups never show up in performance profiles replace them with a

regular spin lock which fixes the races in accesses to those shared

resources.

Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and

seen crashes with apps using shared resources.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Published
2024-08-21T11:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 4.20, < 6.1.76.1.7
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 21 AUG 06:10Z
    drm/vmwgfx: Remove rcu locks from user resources
    cvelistv5