Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd back

CVSS 7.1CVE-2024-36960Kernel, userspace & hypervisorcurated

Impact

A tenant that asks for a fence event on its DRM fd and then reads the fd back gets more bytes than the event actually contains, so adjacent kernel heap memory is copied into its buffer. That is a straight kernel-memory read primitive from an unprivileged process - enough to defeat KASLR and to harvest residual data left by other work on the box.

Who can reach it

An unprivileged process inside a VMware-hosted guest holding /dev/dri/card* or /dev/dri/renderD*: issue the vmwgfx fence-event ioctl, then read() the DRM fd. No capabilities needed. Only applies where vmwgfx is the GPU driver (ESXi/Workstation guests), so the exposure is tenant VMs, not bare-metal GPU nodes.

What to do

Boot a kernel carrying the fix (the record lists no fixed_in - take the stable backport from your distro tree, commits below). Interim: do not expose /dev/dri to untrusted processes inside vmwgfx guests.

References

https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9 https://nvd.nist.gov/vuln/detail/CVE-2024-36960

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.