Critical Race Condition in Linux Kernel's vmwgfx Driver
Summary
CVE-2022-48887: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The vmwgfx driver is specifically designed for VMware graphics, enabling efficient rendering and display functionalities. This driver is crucial for applications that rely on virtualized graphics environments. However, it has been found to have a vulnerability that can lead to system crashes when user resources are accessed concurrently.
Vulnerability Detail
In the Linux kernel, specifically within the vmwgfx driver, a race condition was identified due to improper use of RCU (Read-Copy-Update) locks during user resource lookups. This flaw allows for command buffers to be submitted from multiple threads simultaneously, leading to potential crashes of the driver. The vulnerability can result in kernel oops errors, particularly evident during stress tests and when applications utilize shared resources. The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid submitting command buffers from multiple threads simultaneously until the kernel is updated. This can help mitigate the risk of crashes while waiting for a permanent fix.
Conclusion
The CVE-2022-48887 vulnerability in the Linux kernel's vmwgfx driver poses a moderate risk due to a race condition that can lead to system crashes. Users are advised to update their kernel to the latest version to mitigate this risk. For those unable to update immediately, a temporary workaround is available. Monitoring tools like Vulert can help in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-48887 is a vulnerability in the Linux kernel's vmwgfx driver that can lead to system crashes due to a race condition in user resource lookups.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by CVE-2022-48887.
The vulnerability can cause kernel oops errors and crashes in applications that utilize shared resources, leading to system instability.
Yes, updating the Linux kernel to the fixed version (6.1.7-1 or later) will resolve the vulnerability.
If an immediate update is not possible, avoid using shared resources from multiple threads as a temporary workaround to reduce the risk of crashes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
