CVE-2024-46712

What it actually does

The flaw permits creation of coherent dumb buffers in vmwgfx when 3D acceleration is disabled, causing unnecessary guest-host synchronization and exhaustion of constrained graphics memory (typically 16MB) used by console framebuffer, cursors, and login managers.

Why it matters to the business

Systems running VMware graphics without 3D acceleration can experience graphics memory exhaustion, resulting in failures of display components, degraded VM usability, and potential denial of service in virtualized environments; prevalence in Linux kernel deployments increases exposure for affected hosts.

How an attack unfolds

An attacker with access to a guest VM using vmwgfx without 3D enabled allocates coherent dumb buffers through DRM interfaces; the driver performs excess synchronization work, rapidly consuming the limited graphics memory pool and triggering resource starvation for essential display functions.

How to fix it

Upgrade the Linux kernel to version 6.10.8 or apply commit c45558414b8f2e0b9dc34eb8f9d4e8359b887681. For affected Kubernetes packages, upgrade to 1.16.11, 1.17.7, or 1.18.4 as appropriate. Reboot systems after applying the kernel update.

How to confirm the fix worked

Confirm the running kernel reports version 6.10.8 or later; inspect vmwgfx driver source or runtime configuration to verify coherent dumb buffers are rejected when 3D is disabled; test buffer allocation under memory-constrained 3D-disabled scenarios.

Typical attack path

1. Confirm vmwgfx driver is active in a configuration without 3D acceleration
2. Use DRM APIs to allocate multiple coherent dumb buffers
3. Trigger repeated synchronization operations to exhaust the 16MB graphics memory limit
4. Observe failure of pinned console framebuffer, cursors, or graphical login manager

How to detect it

Review kernel logs for drm/vmwgfx memory allocation failures or exhaustion warnings under 3D-disabled conditions; examine guest VM graphics driver initialization logs for coherent buffer usage patterns; no widespread exploitation artifacts reported.

What your security team should do

• Apply kernel updates to 6.10.8 or equivalent fixed commit on all systems using vmwgfx
• Audit graphics configurations to disable 3D only where required and verify memory limits
• Monitor graphics memory usage metrics in virtualized hosts for early signs of exhaustion
• Prioritize patching on high-density VM hosts given kernel ecosystem prevalence