Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream were

Impact

The dimensions of a DMA surface-copy box submitted in the command stream were never validated against the size of the destination image buffer, so a tenant-chosen copy box overflows the kernel-side memcpy. That is an out-of-bounds kernel heap write with attacker-controlled length and content - memory corruption, not just a crash.

Who can reach it

A tenant process holding /dev/dri/renderD* on a vmwgfx device submits a surface DMA command with an oversized copy box through the normal command-submission ioctl; the overflow happens while the kernel validates and snoops that command, before any display involvement. Conditional on vmwgfx being the DRM driver (VMware-backed nodes).

What to do

Boot a kernel carrying the vmwgfx copybox validation fix below. Interim: remove /dev/dri/* from untrusted containers on VMware-backed nodes, or blacklist vmwgfx where 3D is not required.

References