CVE-2022-38096

2022-10-1314:30:18

redhat.com

access.redhat.com

linux kernel

vmwgfx driver

null pointer dereference

local attacker

denial of service

ioctl()

blacklisting

kernel module.

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A NULL pointer dereference issue was found in the Linux kernel’s vmwgfx driver in vmw_cmd_dx_define_query. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, who can issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service.

Mitigation

To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the vmwgfx kernel module. For instructions relating to blacklisting a kernel module, please see <https://access.redhat.com/solutions/41278>.