In the Linux kernel, the following vulnerability has been resolved:
tty: Fix out-of-bound vmalloc access in imageblit
This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.
If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value.
To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-uki-virtUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade perfUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernelUpgrade rtlaUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-debug-uki-virtUpgrade kernel-modules-coreUpgrade kernel-develUpgrade kernel-64k-debug-modulesUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-64kUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-64k-debug-develUpgrade kernel-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-modulesUpgrade kernel-64k-develUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-core | Sep 26, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-livepatch-4.14.252-195.481Upgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernelUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64 | Mar 14, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Jul 16, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 13, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade libperf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-modules-coreUpgrade kernel-headersUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-develUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade libperfUpgrade kernel-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade rtlaUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-preemptUpgrade kernel-rtUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-amazonUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade dtb-rockchipUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-macrosUpgrade dtb-appleUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-default-manUpgrade dtb-freescaleUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-azure-baseUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-rtUpgrade kernel-source-azureUpgrade dtb-socionextUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade kernel-trace-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade dtb-qcomUpgrade kernel-rt_debug-develUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-rtUpgrade dtb-lgUpgrade dlm-kmp-azureUpgrade kernel-xenUpgrade dtb-sprdUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade kernel-syms-rtUpgrade kernel-ec2Upgrade kernel-devel-azureUpgrade kernel-rt-optionalUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-ec2-develUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-xilinxUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kbUpgrade kernel-ec2-baseUpgrade kernel-kvmsmall-develUpgrade dtb-caviumUpgrade kernel-trace-baseUpgrade kernel-preempt-develUpgrade dtb-amdUpgrade kernel-default-develUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-traceUpgrade kernel-develUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-azureUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-apmUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-debugUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-armUpgrade kernel-xen-develUpgrade kselftests-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-debug-develUpgrade kernel-xen-baseUpgrade reiserfs-kmp-azure | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-kvmUpgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-ibmUpgrade linux-aws-5.4Upgrade linuxUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linux-gkeopUpgrade linux-raspiUpgrade linux-oracleUpgrade linux-aws-hweUpgrade linux-hwe-5.4Upgrade linux-azure-fde-5.15Upgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-azureUpgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-gcpUpgrade linux-gcp-4.15Upgrade linux-azure-4.15Upgrade linux-azure-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub