CVE-2022-48887

drm/vmwgfx: Remove rcu locks from user resources

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a	patch
https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50	patch

Frequently Asked Questions

What is the severity of CVE-2022-48887?: CVE-2022-48887 has been scored as a medium severity vulnerability.
How to fix CVE-2022-48887?: To fix CVE-2022-48887, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-48887 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-48887 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-48887?: CVE-2022-48887 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.