In the Linux kernel, the following vulnerability has been resolved:
fbmem: Do not delete the mode that is still in use
The execution of fb_delete_videomode() is not based on the result of the previous fbcon_mode_deleted(). As a result, the mode is directly deleted, regardless of whether it is still in use, which may cause UAF.
================================================================== BUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \ drivers/video/fbdev/core/modedb.c:924 Read of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962
CPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x137/0x1be lib/dump_stack.c:118 print_address_description+0x6c/0x640 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x13d/0x1e0 mm/kasan/report.c:562 fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924 fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746 fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 18960: kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x3d/0x70 mm/kasan/common.c:56 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1541 [inline] slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574 slab_free mm/slub.c:3139 [inline] kfree+0xca/0x3d0 mm/slub.c:4121 fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104 fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-rtUpgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-rt-kvm | Sep 26, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.59-52.142Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-devel | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Sep 25, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade bpftool-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-rtUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-rt-modules-extra | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-default-baseUpgrade kernel-preemptUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-preempt-develUpgrade kernel-defaultUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-oracle-5.4Upgrade linuxUpgrade linux-azure-fipsUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-hwe-5.4Upgrade linux-fipsUpgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-ibmUpgrade linux-raspiUpgrade linux-gcp-fipsUpgrade linux-azure-5.4Upgrade linux-kvmUpgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-azureUpgrade linux-aws-fipsUpgrade linux-gkeop | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub