CVE-2022-36402

What it actually does

Integer overflow in vmwgfx_execbuf.c allows memory corruption when processing commands sent to the /dev/dri/renderD* device file, resulting in denial of service or local privilege escalation.

Why it matters to the business

Local users on affected Linux systems can crash graphics subsystems or escalate privileges, leading to system instability, potential data exposure, and operational disruption on servers or workstations using VMware GPU drivers.

How an attack unfolds

A local attacker with a standard user account sends specially crafted GPU command buffers through the render device file; the integer overflow in the vmwgfx driver corrupts kernel memory structures, enabling DoS or elevation of privileges. No widespread exploitation by named actors has been observed despite the long publication window.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the vmwgfx integer overflow; apply all available distribution security updates for the GPU driver component and reboot affected systems.

How to confirm the fix worked

Verify the running kernel version against distribution advisories that address the vmwgfx_execbuf integer overflow; confirm the vulnerable code path in drivers/gpu/vmwgfx/vmwgfx_execbuf.c has been patched and test that local render device access no longer triggers the overflow condition.

Typical attack path

1. Obtain a local user account on the target Linux system
2. Open the /dev/dri/renderD* device file
3. Craft and submit malicious execbuf commands triggering the integer overflow
4. Corrupt kernel memory to achieve DoS or privilege escalation

How to detect it

Review kernel logs for vmwgfx-related errors or crashes around GPU command processing; inspect audit logs for unusual access patterns to render device files; correlate with any sudden DoS events on systems using the VMware GPU driver.

What your security team should do

• Prioritize kernel updates on all systems exposing GPU render devices
• Restrict unprivileged access to /dev/dri/renderD* files via device permissions or cgroups where feasible
• Monitor kernel update channels for backported fixes given the 1492-day publication age and stable low EPSS
• Audit local user accounts and GPU device usage on multi-tenant Linux hosts