Linux kernel (drivers/gpu/drm/vmwgfx): When the copy of the fence reply back to userspace fails, the driver installs a

Impact

When the copy of the fence reply back to userspace fails, the driver installs a file descriptor it then tears down without releasing the fd table slot, leaving the tenant with a valid descriptor pointing at a freed file object. The tenant chooses when the copy fails, so this is a reliable, on-demand use-after-free on a core kernel object - the classic path to full kernel code execution from an unprivileged process.

Who can reach it

A tenant process holding /dev/dri/renderD* (or card*) on a vmwgfx device issues the execbuf or fence-event ioctl with a fence-reply pointer it has arranged to fault (unmapped or read-only page), then keeps using the leftover descriptor. Requires vmwgfx to be the DRM driver, i.e. workloads running inside VMware VMs. No privilege beyond the device node.

What to do

Boot a kernel carrying the vmwgfx fd_install ordering fix below. Interim: drop /dev/dri/* from untrusted containers running on VMware-backed nodes, or blacklist vmwgfx on nodes where the guest does not need 3D.

References