{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-36960","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-30T15:25:07.081Z","datePublished":"2024-06-03T07:49:58.951Z","dateUpdated":"2026-08-05T11:32:14.684Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:32:14.684Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix invalid reads in fence signaled events\n\nCorrectly set the length of the drm_event to the size of the structure\nthat's actually used.\n\nThe length of the drm_event was set to the parent structure instead of\nto the drm_vmw_event_fence which is supposed to be read. drm_read\nuses the length parameter to copy the event to the user space thus\nresuling in oob reads."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is triggered through the DRM_IOCTL_VMW_FENCE_EVENT ioctl followed by read() on a vmwgfx DRM file descriptor (/dev/dri/renderD128), which requires local access to the guest system. There is no network-facing path to this code.\nAC:L - Exploitation is fully deterministic — a single ioctl followed by a read reliably copies 72 bytes past the end of the allocation, with no race, no timing window, and no attacker-uncontrolled precondition. Heap grooming of the kmalloc-96 cache to control the leaked neighbour is standard and repeatable at will.\nPR:L - The ioctl is marked DRM_RENDER_ALLOW, so it is served on the render node which is world-accessible (0666 or group \"render\") on typical VMware guest desktop/workstation installs — no DRM master, DRM_AUTH, or capability check is applied. Any unprivileged local user with a graphics session or render-node access can reach it.\nUI:N - The attacker opens its own DRM fd, issues the ioctl and reads the event entirely within its own process. No victim action or interaction of any kind is required.\nS:U - The leaked data is guest kernel heap memory disclosed to guest userspace, and any resulting crash is confined to the same kernel. The vulnerable component and the impacted resources share one security authority; there is no guest-to-host or IOMMU boundary crossing.\nC:H - 72 bytes of adjacent kernel slab memory are copied verbatim to userspace on every event read, and the attacker can groom the kmalloc-96 cache and repeat the read indefinitely to harvest kernel pointers, SLUB freelist values and residual object contents. This is a substantial, repeatable kernel heap information disclosure enabling KASLR/heap-address defeat, not a strictly bounded few-byte read.\nI:N - The defect is purely an over-long read; no data is written out of bounds and the inflated length is applied symmetrically to the event_space reserve/release accounting, so no kernel state is corrupted. There is no write or control-flow primitive.\nA:H - On the many distro and Android kernels built with CONFIG_HARDENED_USERCOPY=y, __check_heap_object() rejects the 96-byte copy starting at offset 72 of a 96-byte object and calls usercopy_abort(), which invokes BUG() — an unprivileged local user can therefore force a kernel oops (or full panic with panic_on_oops) on demand."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"],"versions":[{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"2f527e3efd37c7c5e85e8aa86308856b619fa59f","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"cef0962f2d3e5fd0660c8efb72321083a1b531a9","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"3cd682357c6167f636aec8ac0efaa8ba61144d36","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"b7bab33c4623c66e3398d5253870d4e88c52dfc0","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"0dbfc73670b357456196130551e586345ca48e1b","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"7b5fd3af4a250dd0a2a558e07b43478748eb5d22","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"deab66596dfad14f1c54eeefdb72428340d72a77","status":"affected","versionType":"git"},{"version":"8b7de6aa84682a3396544fd88cd457f95484573a","lessThan":"a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"],"versions":[{"version":"3.4","status":"affected"},{"version":"0","lessThan":"3.4","status":"unaffected","versionType":"semver"},{"version":"4.19.314","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.276","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.217","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.159","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.91","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.31","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.10","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"4.19.314"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"5.4.276"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"5.10.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"5.15.159"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"6.1.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"6.6.31"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"6.8.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f"},{"url":"https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9"},{"url":"https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36"},{"url":"https://git.kernel.org/stable/c/b7bab33c4623c66e3398d5253870d4e88c52dfc0"},{"url":"https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1b"},{"url":"https://git.kernel.org/stable/c/7b5fd3af4a250dd0a2a558e07b43478748eb5d22"},{"url":"https://git.kernel.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77"},{"url":"https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c"}],"title":"drm/vmwgfx: Fix invalid reads in fence signaled events","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-36960","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-06-03T13:45:10.318634Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:47:40.946Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:43:50.585Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b7bab33c4623c66e3398d5253870d4e88c52dfc0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7b5fd3af4a250dd0a2a558e07b43478748eb5d22","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}