In the Linux kernel, the following vulnerability has been resolved:
tty: Fix out-of-bound vmalloc access in imageblit
This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.
If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value.
To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libsUpgrade kernel-devel-matchedUpgrade kernel-64k-develUpgrade kernel-64k-debug-coreUpgrade kernel-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-cross-headersUpgrade kernel-64k-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade libperfUpgrade kernel-modules-coreUpgrade kernel-64k-debug-develUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-64k-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-64kUpgrade kernelUpgrade rtlaUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade rvUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-docUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernel-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdumpUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extra | Sep 26, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-develUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.252-195.481Upgrade kernel-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.75-79.358Upgrade python-perf-debuginfoUpgrade kernel-headers | Mar 14, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Jul 16, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Sep 13, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade python3-perfUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-rt-kvmUpgrade kernel-debug-uki-virtUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-uki-virtUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-coreUpgrade perfUpgrade kernel-debug-coreUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade bpftoolUpgrade kernel-rt-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernelUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade libperf-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-debuginfoUpgrade libperfUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade rvUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-cross-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade kernel-azure-baseUpgrade kernel-rt_debug-vdsoUpgrade dtb-nvidiaUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-ec2-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade kernel-azure-develUpgrade dlm-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-macrosUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade kernel-preemptUpgrade kernel-default-manUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-azureUpgrade dtb-marvellUpgrade kernel-trace-develUpgrade dtb-amazonUpgrade kernel-obs-buildUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rtUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kselftests-kmp-rtUpgrade kernel-syms-azureUpgrade dtb-sprdUpgrade gfs2-kmp-rtUpgrade dtb-qcomUpgrade dlm-kmp-rtUpgrade dtb-lgUpgrade kernel-azure-extraUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-xenUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade kernel-azure-optionalUpgrade kernel-ec2Upgrade kernel-source-rtUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade dtb-appleUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-obs-qaUpgrade kernel-xen-develUpgrade kernel-64kb-develUpgrade kernel-rt-livepatchUpgrade kernel-trace-baseUpgrade kernel-default-optionalUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-ec2-baseUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade dtb-xilinxUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade kernel-kvmsmall-develUpgrade dtb-hisiliconUpgrade dtb-armUpgrade kernel-traceUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade dtb-renesasUpgrade kernel-debug-develUpgrade kernel-devel-rtUpgrade kernel-default-develUpgrade dtb-amdUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-develUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade kernel-xen-baseUpgrade dtb-caviumUpgrade kernel-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-preempt-develUpgrade kernel-default-base | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-aws-5.4Upgrade linux-azure-fde-5.15Upgrade linux-gcp-5.4Upgrade linux-fipsUpgrade linux-aws-fipsUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-ibmUpgrade linux-raspiUpgrade linux-aws-hweUpgrade linux-oracle-5.4Upgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-gcp-fipsUpgrade linux-bluefieldUpgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-hweUpgrade linux-gcpUpgrade linux-raspi-5.4Upgrade linux-gcp-4.15Upgrade linux-aws | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub