Skip to content
Heist/ feed
Back to feed
UnratedFix available

drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.229, 5.15.170, 5.4.285, 6.1.115, 6.11.6, 6.6.59
CVEs
CVE-2024-50134
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 18:52 UTC · Revision 1

Source evidence

drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

core-osv · Original source

Published 5 Nov 2024, 17:10 UTC

In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.

osv:CVE-2024-50134

Kernel

Fixed versions: 5.4.285, 5.10.229, 5.15.170, 6.1.115, 6.6.59, 6.11.6

Complete source record
{
  "id": "e8ac37c8d2c73bd24ad8964c109dcb3a141cd0086d69a5cc19ea93b678998948",
  "url": "https://osv.dev/vulnerability/CVE-2024-50134",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a \"memcpy: detected field-spanning write error\" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field \"p->data\" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.",
    "evidence": "osv:CVE-2024-50134",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.4.285",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.229",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.170",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.115",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.59",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.11.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2024-50134",
      "aliases": [
        "CVE-2024-50134"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "dd55d44f408419278c00887bfcb2261d0caae350"
                },
                {
                  "fixed": "02c86c5d5ef4bbba17d38859c74872825f536617"
                },
                {
                  "fixed": "75f828e944dacaac8870418461d3d48a1ecf2331"
                },
                {
                  "fixed": "34a422274b693507025a7db21519865d1862afcb"
                },
                {
                  "fixed": "7458a6cdaebb3dc59af8578ee354fae78a154c4a"
                },
                {
                  "fixed": "9eb32bd23bbcec44bcbef27b7f282b7a7f3d0391"
                },
                {
                  "fixed": "fae9dc12c61ce23cf29d09824a741b7b1ff8f01f"
                },
                {
                  "fixed": "d92b90f9a54d9300a6e883258e79f36dab53bfae"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50134.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.13.0"
                },
                {
                  "fixed": "5.4.285"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.229"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.170"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.115"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.59"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.11.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50134.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.507535591Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
        "https://git.kernel.org/stable/c/02c86c5d5ef4bbba17d38859c74872825f536617",
        "https://git.kernel.org/stable/c/34a422274b693507025a7db21519865d1862afcb",
        "https://git.kernel.org/stable/c/7458a6cdaebb3dc59af8578ee354fae78a154c4a",
        "https://git.kernel.org/stable/c/75f828e944dacaac8870418461d3d48a1ecf2331",
        "https://git.kernel.org/stable/c/9eb32bd23bbcec44bcbef27b7f282b7a7f3d0391",
        "https://git.kernel.org/stable/c/d92b90f9a54d9300a6e883258e79f36dab53bfae",
        "https://git.kernel.org/stable/c/fae9dc12c61ce23cf29d09824a741b7b1ff8f01f",
        "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
        "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50134.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-50134",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50134.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-50134",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 520138,
  "published_at": "2024-11-05T17:10:58.939+00:00"
}