CVE-2021-47383
Assigner: Linux
Published: 2024-05-21T15:03:44.286Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl
FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct
containing only the fields xres, yres, and bits_per_pixel
with values.

If this struct is the same as the previous ioctl, the
vc_resize() detects it and doesn't call the resize_screen(),
leaving the fb_var_screeninfo incomplete. And this leads to
the updatescrollmode() calculates a wrong value to
fbcon_display->vrows, which makes the real_y() return a
wrong value of y, and that value, eventually, causes
the imageblit to access an out-of-bound address value.

To solve this issue I made the resize_screen() be called
even if the screen does not need any resizing, so it will
"fix and fill" the fb_var_screeninfo independently.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 1da177e4c3f4
lessThan: 7e71fcedfda6
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 70aed03b1d5a
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 067c694d0604
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 8a6a240f52e1
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 883f7897a25e
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: d570c48dd37d
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 699d926585da
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 3b0c40612471
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 4.4.286
lessThanOrEqual: 4.4.*
status: unaffected
versionType: custom
version: 4.9.285
lessThanOrEqual: 4.9.*
status: unaffected
versionType: custom
version: 4.14.249
lessThanOrEqual: 4.14.*
status: unaffected
versionType: custom
version: 4.19.209
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.151
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.71
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.14.10
lessThanOrEqual: 5.14.*
status: unaffected
versionType: custom
version: 5.15
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: tty: Fix out-of-bound vmalloc access in imageblit
x_generator: engine: bippy-d175d3acf727