CVE-2022-50440

A flaw was discovered in the Linux kernel’s DRM vmwgfx driver related to how cursor images are snooped and copied. When the dimensions of a DMA surface copybox were derived from untrusted userspace data without proper validation against the expected snooped cursor size, an invalid size could cause an oversized memcpy operation. This may lead to a buffer overflow condition and crash the kernel when rendering or handling VMware graphics cursor updates.

This vulnerability is rated Moderate because exploitation requires authenticated local access to the graphics subsystem within a virtualized guest, restricting potential disruption to local denial of service or bounded memory corruption. Bare-metal environments and virtual instances hosted on non-VMware hypervisors do not load the vmwgfx driver and remain unaffected. In typical Red Hat Enterprise Linux server deployments operating without local graphical sessions, the attack surface is significantly reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the vmwgfx kernel module from loading. This is suitable for systems not running as VMware guests or not requiring VMware graphics.

1. Create /etc/modprobe.d/blacklist-vmwgfx.conf with:

   blacklist vmwgfx
   install vmwgfx /bin/true
   

2. Regenerate the initramfs: For RHEL 7: dracut -f -v For RHEL 8/9: dracut -f --regenerate-all
3. Reboot the system.

This may impact graphical functionality if VMware graphics are required.