VDB

UBUNTU-CVE-2022-36280

UBUNTU-CVE-2022-36280 PUBLISHED CVSS 7.300000190734863 HIGH

Record from OSV · Published September 9, 2022

An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-aws-hweUbuntu:Pro:16.04:LTS4.15.0-1153.166~16.04.1
linux-gkeUbuntu:20.04:LTS5.4.0-1095.102
linux-ibm-5.4Ubuntu:18.04:LTS5.4.0-1045.50~18.04.1
linux-aws-fipsUbuntu:Pro:FIPS-updates:18.04:LTS4.15.0-2092.98
linux-gke-5.15Ubuntu:20.04:LTS5.15.0-1029.34~20.04.1
linux-azure-5.4Ubuntu:18.04:LTS5.4.0-1104.110~18.04.1
linux-kvmUbuntu:22.04:LTS5.15.0-1030.35
linux-oracleUbuntu:18.04:LTS4.15.0-1116.127
linux-gcp-fipsUbuntu:Pro:FIPS-updates:20.04:LTS5.4.0-1101.110+fips1
linux-raspiUbuntu:22.04:LTS5.15.0-1026.28
linux-hweUbuntu:Pro:16.04:LTS4.15.0-208.219~16.04.1
linux-nvidiaUbuntu:22.04:LTS5.15.0-1023.23

49 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
7.300000190734863
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
Ubuntu:Pro:16.04:LTSlinux-aws-hwe4.15.0-1140.151~16.04.1, 4.15.0-1139.150~16.04.1, 4.15.0-1102.109~16.04.1
Ubuntu:20.04:LTSlinux-gke5.4.0-1042.44, 0, 5.4.0-1033.35
Ubuntu:18.04:LTSlinux-ibm-5.45.4.0-1031.35~18.04.1, 5.4.0-1034.38~18.04.1, 5.4.0-1036.41~18.04.1
Ubuntu:18.04:LTSlinux-azure-edge5.0.0-1012.12~18.04.2, 0, 4.18.0-1008.8~18.04.1
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-aws-fips4.15.0-2022.22, 4.15.0-2025.25, 4.15.0-2026.26
Ubuntu:20.04:LTSlinux-oem-5.65.6.0-1056.60, 5.6.0-1033.35, 5.6.0-1034.36
Ubuntu:20.04:LTSlinux-gke-5.155.15.0-1011.14~20.04.1, 0, 5.15.0-1028.33~20.04.1
Ubuntu:18.04:LTSlinux-azure-5.45.4.0-1095.101~18.04.1, 0, 5.4.0-1020.20~18.04.1
Ubuntu:22.04:LTSlinux-kvm5.13.0-1010.11+22.04.1, 5.15.0-1002.2, 5.15.0-1004.4
Ubuntu:18.04:LTSlinux-oracle4.15.0-1053.57, 0, 4.15.0-1007.9
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-gcp-fips5.4.0-1086.94+fips1, 0, 5.4.0-1021.21+fips1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1023.25, 5.15.0-1024.26, 5.15.0-1025.27
Ubuntu:Pro:16.04:LTSlinux-hwe4.15.0-118.119~16.04.1, 4.10.0-35.39~16.04.1, 4.15.0-58.64~16.04.1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1017.17, 0, 5.15.0-1015.15
Ubuntu:20.04:LTSlinux-oracle-5.115.11.0-1016.17~20.04.1, 5.11.0-1008.8~20.04.1, 5.11.0-1028.31~20.04.1
Ubuntu:22.04:LTSlinux-hwe-5.195.19.0-41.42~22.04.1, 5.19.0-40.41~22.04.1, 0
Ubuntu:20.04:LTSlinux-riscv-5.115.11.0-1018.19~20.04.2, 5.11.0-1017.18~20.04.1, 5.11.0-1015.16~20.04.1
Ubuntu:20.04:LTSlinux-gcp-5.115.11.0-1024.26~20.04.1, 5.11.0-1009.10~20.04.1, 0
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.195.19.0-1018.19~22.04.1, 0, 5.19.0-1021.22~22.04.1
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-fips5.4.0-1031.36, 5.4.0-1032.37, 5.4.0-1033.38

…and 116 more

Timeline

  • Sep 9, 2022 CVE Published
  • Oct 28, 2026 CVE Updated
  • Oct 30, 2026 Distribution Patch (26 in total, the first dated here)
  • Oct 30, 2026 Security Advisory (26 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2022-36280
vulnetix vdb fixes UBUNTU-CVE-2022-36280

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2022-36280/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 8 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›