A privilege escalation vulnerability was found in vmwgfx driver in drivers/gpu/drm/vmwgfx/vmwgfx_drv.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). This vulnerability can be quickly verified by the following code logic: ... dri_fd = open("/dev/dri/renderD128", O_RDWR); ret = ioctl(dri_fd, 0xC0186441, &arg); if (ret == 0) { printf("[*] VMW_ALLOC_DMABUF Success!\n"); } ... Submit this commit to fix it. Signed-off-by: Meng Tang <tangmeng@xxxxxxxxxxxxx> --- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c index bd02cb0e6837..115787697957 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c @@ -1263,6 +1263,10 @@ static long vmw_generic_ioctl(struct file *filp, unsigned int cmd, if (!drm_is_current_master(file_priv) && !capable(CAP_SYS_ADMIN)) return -EACCES; + } else if (nr == DRM_COMMAND_BASE + DRM_VMW_ALLOC_DMABUF) { + if (!drm_is_current_master(file_priv) && + !capable(CAP_SYS_ADMIN)) + return -EPERM; } if (unlikely(ioctl->cmd != cmd)) -- 2.20.1