[LTS 8.8] CVE-2023-5633

[pvts-mat]

[LTS 8.8]
CVE-2023-5633
VULN-8160

Problem

https://www.cve.org/CVERecord?id=CVE-2023-5633

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

Applicability analysis

The contents of the files identified in #211 as the complete problem's domain are exactly the same in ciqlts8_8 as they are in ciqlts9_2

git --no-pager diff ciqlts8_8 ciqlts9_2 -- \
drivers/gpu/drm/vmwgfx/Kconfig \
drivers/gpu/drm/vmwgfx/Makefile \
drivers/gpu/drm/vmwgfx/ttm_object.h \
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c \
drivers/gpu/drm/vmwgfx/vmwgfx_bo.h \
drivers/gpu/drm/vmwgfx/vmwgfx_context.c \
drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c \
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c \
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h \
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c \
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c \
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c \
drivers/gpu/drm/vmwgfx/vmwgfx_gem.c \
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c \
drivers/gpu/drm/vmwgfx/vmwgfx_kms.h \
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c \
drivers/gpu/drm/vmwgfx/vmwgfx_prime.c \
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c \
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c \
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c \
drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c \
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c \
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c \
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c \
drivers/gpu/drm/vmwgfx/vmwgfx_va.c

which means that regardless of ciqlts8_8's vmwgfx driver's history the situation regarding CVE's applicability is the same as that of ciqlts9_2, which see.

The only difference can be found in the drivers/gpu/drm/vmwgfx/ttm_object.c file

diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c
index bb350560f..26a55fef1 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -48,9 +48,12 @@
#include <linux/spinlock.h>
#include <linux/slab.h>
#include <linux/atomic.h>
+#include <linux/module.h>
#include "ttm_object.h"
#include "vmwgfx_drv.h"
+MODULE_IMPORT_NS(DMA_BUF);
+
/**
* struct ttm_object_file
*

which is related to the increased debugging information only, from the b9af383 commit

dma-buf: move dma-buf symbols into the DMA_BUF module namespace
Bugzilla: http://bugzilla.redhat.com/2030754
CVE: CVE-2021-44733
commit 16b0314aa746be6c84c0bc6eca9dde0dce2e99df
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun Oct 10 14:46:28 2021 +0200
dma-buf: move dma-buf symbols into the DMA_BUF module namespace
In order to better track where in the kernel the dma-buf code is used,
put the symbols in the namespace DMA_BUF and modify all users of the
symbols to properly import the namespace to not break the build at the
same time.
Now the output of modinfo shows the use of these symbols, making it
easier to watch for users over time:

[kerneltoast]

I completed maybe 90% of the backport for this back in my first week: https://github.com/ctrliq/kernel-src-tree/commits/%7Bsultan%7D_VULN-8160_ciqlts8_8/

[PlaidCat]

LTS has been deprecated we're going to cancel this one.