Date: Thu, 27 Jan 2022 23:20:48 +0100 From: Mathias Krause <minipli@...ecurity.net> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: CVE-2022-22942: Linux kernel: wrong file descriptor handling in the vmwgfx driver Am 27.01.22 um 21:00 schrieb Mathias Krause: > Exploiting this vulnerability requires an attacker to have access to > either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an > ioctl() on the resulting file descriptor. Forgot to mention, as per linux-distros' list policy, an exploit for the vulnerability will be provided in 7 days, as one has been shared with the linux-distros before. Meanwhile the patch was merged into Linux mainline: https://git.kernel.org/linus/a0f90c881570 Thanks, Mathias Download attachment "OpenPGP_signature" of type "application/pgp-signature" (666 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.