In the Linux kernel, the following vulnerability has been resolved:
fbcon: always restore the old font data in fbcon_do_set_font()
Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure (of vc_resize()). But it performs so only for user fonts. It means that the "system"/internal fonts are not restored at all. So in result, the very first call to fbcon_do_set_font() performs no restore at all upon failing vc_resize().
This can be reproduced by Syzkaller to crash the system on the next invocation of font_get(). It's rather hard to hit the allocation failure in vc_resize() on the first font_set(), but not impossible. Esp. if fault injection is used to aid the execution/failure. It was demonstrated by Sirius: BUG: unable to handle page fault for address: fffffffffffffff8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc91ce #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286 Call Trace: <TASK> con_font_get drivers/tty/vt/vt.c:4558 [inline] con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803 vfs_ioctl fs/ioctl.c:51 [inline] ...
So restore the font data in any case, not only for user fonts. Note the later 'if' is now protected by 'old_userfont' and not 'old_data' as the latter is always set now. (And it is supposed to be non-NULL. Otherwise we would see the bug above again.)
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.152-100.162 | Aug 28, 2024 | Apr 4, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade python3-perfUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.82-99.168Upgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade kernel-devel | Feb 17, 2025 | Apr 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade dtb-amazonUpgrade dtb-hisiliconUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-source-rtUpgrade dlm-kmp-defaultUpgrade dtb-apmUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade dtb-renesasUpgrade kernel-debugUpgrade kernel-rt-optionalUpgrade dlm-kmp-azureUpgrade kernel-default-develUpgrade kernel-debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-64kb-optionalUpgrade kernel-syms-rtUpgrade cluster-md-kmp-azureUpgrade dtb-marvellUpgrade gfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-amlogicUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade dtb-broadcomUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-socionextUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade kernel-azure-develUpgrade kernel-rt-extraUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-sourceUpgrade kernel-azure-optionalUpgrade dtb-xilinxUpgrade kernel-syms-azureUpgrade dtb-armUpgrade kernel-devel-rtUpgrade dtb-alteraUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade kernel-kvmsmallUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-lgUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade kernel-default-vdso | May 6, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-gkeUpgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-virtualUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.5.0-44-genericUpgrade linux-image-oem-20.04Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-gke-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-6.5.0-1024-azureUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-112-genericUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-intelUpgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-1023-awsUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-20.04bUpgrade linux-image-genericUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-oracleUpgrade linux-image-starfiveUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-azureUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-nvidiaUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidia-6.5 | Jul 1, 2024 | Apr 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub