CVE-2024-50134 drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 6.12 | premières → < 6.12 | 6.12 |
| Linux 6.11 | premières → < 6.11.6 | 6.11.6 |
| Linux 6.6 | premières → < 6.6.59 | 6.6.59 |
| Linux 6.1 | premières → < 6.1.115 | 6.1.115 |
| Linux 5.15 | premières → < 5.15.170 | 5.15.170 |
| Linux 5.10 | premières → < 5.10.229 | 5.10.229 |
| Linux 5.4 | premières → < 5.4.285 | 5.4.285 |
| Linux | 4.13 | Pas de correctif indiqué |
| SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 | premières → < 1.1.1 | 1.1.1 |