CVE-2023-52648

A flaw was found in the Linux kernel's VMware graphics driver (drm/vmwgfx). When transitioning display plane states, the driver fails to clear the mapped surface flag after unreferencing a surface, creating an inconsistent internal state. A local user can exploit this vulnerability during display plane updates to trigger a null pointer dereference in the kernel, leading to a system crash and Denial of Service (DoS).

Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4.z (kernel and kernel-rt), OpenShift Dedicated, Azure Red Hat OpenShift, and Fedora are affected by a moderate-severity flaw in the Linux kernel's VMware graphics driver (drm/vmwgfx). When a display plane state transition unreferences a surface without clearing the mapped-surface flag, the plane state is left internally inconsistent; a local user who can trigger display plane updates can exploit this state to cause a null pointer dereference in the kernel, resulting in a system crash and denial of service. Confidentiality and integrity are not impacted. Red Hat's CVSS 3.1 score (5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) matches the NIST score, so there is no difference from upstream severity. A fix is being pursued through the responsible engineering channels for the affected Red Hat product streams; Red Hat Enterprise Linux 6 and 7 no longer receive updates for this issue because those streams are out of support.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.