Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from the

Impact

The vmwgfx command-buffer parser trusted a size field taken straight from the guest's command stream and used it in buffer offset arithmetic, so an oversized value overflows the calculation and walks the kernel off the end of the command buffer. That is an attacker-chosen out-of-bounds access inside the guest kernel, reachable from any process that can submit GPU commands.

Who can reach it

A container or process inside a VMware guest holding /dev/dri/renderD* submits an execbuf whose SVGA command header declares a size beyond SVGA_CMD_MAX_DATASIZE. Pure userspace-to-kernel input validation failure, no privileges beyond the render node. Applies only where tenants run as VMware guests with the vmwgfx device present.

What to do

Update guest kernels to a build with the fix commits below. Interim: remove /dev/dri from untrusted guest containers, or remove the virtual 3D device from tenant VMs entirely.

References