CVE-2024-50134

What it actually does

The original code used a fake variable-length array at the end of vbva_mouse_pointer_shape, causing memcpy to perform a field-spanning write larger than the declared size of the target field (p->data) in hgsmi_base.c, triggering warnings and potential memory handling issues during pointer shape updates in the vboxvideo driver.

Why it matters to the business

Systems running affected Linux kernels with VirtualBox graphics may experience driver warnings, instability, or crashes during graphics operations, increasing operational overhead for virtualized environments; the low EPSS and lack of KEV status indicate limited real-world urgency despite the buffer handling flaw.

How an attack unfolds

An attacker with local access triggers vbox_cursor_atomic_update which calls hgsmi_update_pointer_shape, leading to the oversized memcpy write; while listed under broad Linux kernel exploitation campaigns, the low CVSS and non-KEV status suggest this is primarily a stability issue rather than a reliably exploitable remote vector.

How to fix it

Update the Linux kernel to the fixed commit 02c86c5d5ef4bbba17d38859c74872825f536617 or later stable versions containing the real VLA replacement for vbva_mouse_pointer_shape; rebuild and deploy the vboxvideo module if using custom kernels.

How to confirm the fix worked

Confirm the kernel source includes the real VLA declaration and comment about length calculation in drivers/gpu/drm/vboxvideo; test by exercising cursor updates and verifying absence of the memcpy field-spanning warning in dmesg.

Typical attack path

1. Obtain local user access on a Linux system using the vboxvideo kernel module
2. Perform graphics operations that update mouse pointer shapes
3. Invoke the hgsmi_update_pointer_shape function triggering the field-spanning memcpy
4. Cause kernel warning or potential denial-of-service through memory handling error

How to detect it

Review kernel logs for the specific memcpy field-spanning write warning mentioning hgsmi_base.c and vboxvideo; check for repeated vbox_cursor_atomic_update call traces during graphics activity on systems with the vboxvideo module loaded.

What your security team should do

• Prioritize kernel updates on systems using VirtualBox or vboxvideo graphics within standard patch cycles
• Monitor for similar VLA-related compiler warnings in other DRM drivers during code reviews
• Apply the exact fixed commit in stable kernel trees before widespread deployment