Created attachment 388 [details]
poc

Description of problem:

There is a NULL pointer vulnerability in vmwgfx driver
Linux VMware guests have the device file /dev/dri/renderD128 (or Dxxx) which can be used to send ioctl()s to VMWare graphics driver, [vmwgfx] module. On some distributions this device is readable and writable by unprivileged users
Vulnerability location:
Drivers/gpu/vmxgfx/vmxgfx_execbuf.c
vmw_cmd_dx_define_query

Vulnerable code:
vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);

ctx_node->ctx is a null pointer when uninitialized
cause kernel crashes

Version-Release number of selected component (if applicable):
5.13.0-53


How reproducible:
In the linux environment of vmware, compile the poc file and execute
Steps to Reproduce:
gcc poc.c -o poc
./poc

Actual results:
DOS

Expected results:
DOS

=*=*=*=*=*=*=*=*=  Credit  =*=*=*=*=*=*=*=*=
ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab

Best Regards,
ziming