CVE-2021-47383

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: Fix out-of-bound vmalloc access in imageblit

This issue happens when a userspace program does an ioctl

FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct

containing only the fields xres, yres, and bits_per_pixel

with values.

If this struct is the same as the previous ioctl, the

vc_resize() detects it and doesn't call the resize_screen(),

leaving the fb_var_screeninfo incomplete. And this leads to

the updatescrollmode() calculates a wrong value to

fbcon_display->vrows, which makes the real_y() return a

wrong value of y, and that value, eventually, causes

the imageblit to access an out-of-bound address value.

To solve this issue I made the resize_screen() be called

even if the screen does not need any resizing, so it will

"fix and fill" the fb_var_screeninfo independently.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References