CVE-2023-52648: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52648 affects the Linux kernel's DRM (Direct Rendering Manager) driver for VMware Virtual GPU (vmwgfx). The vulnerability was discovered in December 2023 and involves a bug in the handling of surface mapping states during plane state transitions (Kernel Git).

The vulnerability occurs in the vmwgfx driver when switching to a new plane state, which requires unreferencing of all held surfaces. During the work required for mob cursors, mapped surfaces were being cached, but the variable indicating whether the surface is currently mapped was not being reset properly. This leads to a situation where the duplicated state incorrectly indicates that a surface is mapped even when no surface is present, potentially causing null pointer dereferences during cleanup operations (Kernel Git).

The vulnerability can cause system crashes, particularly affecting KDE KWin 6.0 on Wayland environments running on VMware virtual machines. When triggered, it results in null pointer dereferences that can lead to system instability and denial of service conditions (Kernel Git).

The vulnerability requires local access to the system and specifically affects systems running the VMware graphics driver (vmwgfx). It can be triggered through normal operation of the KDE KWin desktop environment on Wayland, suggesting that it's relatively easy to trigger under specific conditions (Kernel Git).

The issue has been fixed in the Linux kernel by adding code to unmap the surface and reset the surface_mapped flag before unreferencing the plane state surface. The fix involves modifying the vmw_du_cursor_plane_prepare_fb function in the vmwgfx driver (Kernel Git).