In the Linux kernel, the following vulnerability has been resolved:
fbcon: always restore the old font data in fbcon_do_set_font()
Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure (of vc_resize()). But it performs so only for user fonts. It means that the "system"/internal fonts are not restored at all. So in result, the very first call to fbcon_do_set_font() performs no restore at all upon failing vc_resize().
This can be reproduced by Syzkaller to crash the system on the next invocation of font_get(). It's rather hard to hit the allocation failure in vc_resize() on the first font_set(), but not impossible. Esp. if fault injection is used to aid the execution/failure. It was demonstrated by Sirius: BUG: unable to handle page fault for address: fffffffffffffff8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc91ce #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286 Call Trace: <TASK> con_font_get drivers/tty/vt/vt.c:4558 [inline] con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803 vfs_ioctl fs/ioctl.c:51 [inline] ...
So restore the font data in any case, not only for user fonts. Note the later 'if' is now protected by 'old_userfont' and not 'old_data' as the latter is always set now. (And it is supposed to be non-NULL. Otherwise we would see the bug above again.)
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-headersUpgrade python-perfUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.152-100.162Upgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfo | Aug 28, 2024 | Apr 4, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade perfUpgrade python3-perfUpgrade kernel-livepatch-6.1.82-99.168Upgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel | Feb 17, 2025 | Apr 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 8, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-rt-livepatchUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade dtb-allwinnerUpgrade dtb-qcomUpgrade kernel-symsUpgrade kernel-kvmsmallUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-devel-rtUpgrade kernel-develUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-lgUpgrade kselftests-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-rt-extraUpgrade kernel-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-obs-buildUpgrade kernel-default-base-rebuildUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade gfs2-kmp-rtUpgrade kernel-devel-azureUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amazonUpgrade kernel-64kb-optionalUpgrade dtb-freescaleUpgrade kselftests-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-defaultUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azureUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-obs-qaUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-debug-vdsoUpgrade dtb-marvellUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-source-vanillaUpgrade dlm-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-default-develUpgrade kernel-debug-livepatch-develUpgrade kernel-debugUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade dtb-renesas | May 6, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04bUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-oem-20.04dUpgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-oem-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-gke-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-intelUpgrade linux-image-6.5.0-1024-azureUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-6.5.0-1023-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-lowlatencyUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-azure-fdeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-azureUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-starfiveUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-awsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-oracle | Jul 1, 2024 | Apr 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub