The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 3.4 | 3.16.57 |
| linux / linux_kernel | 3.17 | 3.18.103 |
| linux / linux_kernel | 3.19 | 4.1.52 |
| linux / linux_kernel | 4.2 | 4.4.125 |
| linux / linux_kernel | 4.5 | 4.9.91 |
| linux / linux_kernel | 4.10 | 4.14.31 |
| linux / linux_kernel | 4.15 | 4.15.14 |
| canonical / ubuntu_linux | 16.04 | 16.04.x |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| canonical / ubuntu_linux | 12.04 | 12.04.x |
| canonical / ubuntu_linux | 17.10 | 17.10.x |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 7.0 | 7.0.x |
| debian / debian_linux | 9.0 | 9.0.x |
| redhat / enterprise_linux_desktop | 7.0 | 7.0.x |
| redhat / enterprise_linux_workstation | 7.0 | 7.0.x |
| redhat / enterprise_linux_server | 7.0 | 7.0.x |