[LTS 8.8] CVE-2023-5633

[pvts-mat]

[LTS 8.8]
CVE-2023-5633
VULN-8160

Problem

https://www.cve.org/CVERecord?id=CVE-2023-5633

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

Applicability analysis

The contents of the files identified in #211 as the complete problem's domain are exactly the same in ciqlts8_8 as they are in ciqlts9_2

git --no-pager diff ciqlts8_8 ciqlts9_2 -- \
    drivers/gpu/drm/vmwgfx/Kconfig \
    drivers/gpu/drm/vmwgfx/Makefile \
    drivers/gpu/drm/vmwgfx/ttm_object.h \
    drivers/gpu/drm/vmwgfx/vmwgfx_bo.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_bo.h \
    drivers/gpu/drm/vmwgfx/vmwgfx_context.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_drv.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_drv.h \
    drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_fb.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_fence.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_gem.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_kms.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_kms.h \
    drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_prime.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_resource.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_shader.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_surface.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c \
    drivers/gpu/drm/vmwgfx/vmwgfx_va.c

which means that regardless of ciqlts8_8's vmwgfx driver's history the situation regarding CVE's applicability is the same as that of ciqlts9_2, which see.

The only difference can be found in the drivers/gpu/drm/vmwgfx/ttm_object.c file

diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c
index bb350560f..26a55fef1 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -48,9 +48,12 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/atomic.h>
+#include <linux/module.h>
 #include "ttm_object.h"
 #include "vmwgfx_drv.h"
 
+MODULE_IMPORT_NS(DMA_BUF);
+
 /**
  * struct ttm_object_file
  *

which is related to the increased debugging information only, from the b9af383 commit

dma-buf: move dma-buf symbols into the DMA_BUF module namespace

Bugzilla: http://bugzilla.redhat.com/2030754
CVE: CVE-2021-44733

commit 16b0314aa746be6c84c0bc6eca9dde0dce2e99df
Author: Greg Kroah-Hartman <[email protected]>
Date:   Sun Oct 10 14:46:28 2021 +0200

    dma-buf: move dma-buf symbols into the DMA_BUF module namespace

    In order to better track where in the kernel the dma-buf code is used,
    put the symbols in the namespace DMA_BUF and modify all users of the
    symbols to properly import the namespace to not break the build at the
    same time.

    Now the output of modinfo shows the use of these symbols, making it
    easier to watch for users over time:

[kerneltoast]

I completed maybe 90% of the backport for this back in my first week: https://github.com/ctrliq/kernel-src-tree/commits/%7Bsultan%7D_VULN-8160_ciqlts8_8/