Bug 1203330 (CVE-2022-38457)

Summary:	VUL-0: CVE-2022-38457: kernel: use-after-free found in 'vmw_cmd_res_check' in vmwgfx driver
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Robert Frohl <rfrohl>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	jack, meissner, mhocko, pmladek, security-team, tiwai, tzimmermann
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/341982/
See Also:	https://bugzilla.suse.com/show_bug.cgi?id=1203329
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-38457:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1203329
Bug Blocks:

Description Robert Frohl 2022-09-12 08:51:59 UTC

CVE-2022-38457

A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in
drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device
file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a
user account on the system to gain privilege, causing a denial of service(DoS).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-38457
https://www.cve.org/CVERecord?id=CVE-2022-38457
https://bugzilla.openanolis.cn/show_bug.cgi?id=2074

Comment 7 Takashi Iwai 2022-10-21 06:48:57 UTC

A gentle reminder from Kernel Security Sentinel:
is there any progress in the upstream about this bug?

Comment 8 Petr Mladek 2022-11-16 09:02:42 UTC

I guess that the situation here is the same as in the bug #1203517, e.i. the fix is not available in upstream yet. Am I right, please?

Comment 9 Thomas Zimmermann 2022-11-16 10:20:59 UTC

(In reply to Petr Mladek from comment #8)
> I guess that the situation here is the same as in the bug #1203517, e.i. the
> fix is not available in upstream yet. Am I right, please?

No changes here.

Comment 16 Jan Kara 2023-08-31 11:37:34 UTC

Based on bug 1203329 this seems like a candidate for WONTFIX...

Comment 18 Thomas Zimmermann 2023-09-05 08:08:27 UTC

I have updated the patch file for bug 1213632 in SLE15-SP5 with the number and CVE of this bug report. I consider this issue fixed.

Comment 23 Maintenance Automation 2023-09-14 12:30:57 UTC

SUSE-SU-2023:3599-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.14.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 24 Maintenance Automation 2023-09-18 16:30:20 UTC

SUSE-SU-2023:3656-1: An update that solves 20 vulnerabilities, contains eight features and has 54 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214760, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1
Public Cloud Module 15-SP5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Maintenance Automation 2023-09-20 12:30:17 UTC

SUSE-SU-2023:3704-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 26 Maintenance Automation 2023-09-21 12:30:04 UTC

SUSE-SU-2023:3599-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Maintenance Automation 2023-09-21 12:30:56 UTC

SUSE-SU-2023:3704-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 28 Maintenance Automation 2023-10-04 16:30:04 UTC

SUSE-SU-2023:3971-1: An update that solves 20 vulnerabilities, contains eight features and has 58 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-obs-qa-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1, kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-source-5.14.21-150500.55.28.1
Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 29 Maintenance Automation 2023-10-05 16:29:12 UTC

SUSE-SU-2023:3988-1: An update that solves 24 vulnerabilities, contains 10 features and has 64 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1065729, 1120059, 1177719, 1187236, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1208995, 1209284, 1209799, 1210048, 1210169, 1210448, 1210643, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214813, 1214873, 1214928, 1214976, 1214988, 1215123, 1215124, 1215148, 1215221, 1215523
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-1192, CVE-2023-1859, CVE-2023-2007, CVE-2023-20588, CVE-2023-2177, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569, CVE-2023-4881
Jira References: PED-2023, PED-2025, PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-source-rt-5.14.21-150500.13.18.1
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.18.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 31 Robert Frohl 2023-10-26 09:14:33 UTC

done