CVE-2023-52973

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

After a call to console_unlock() in vcs_read() the vc_data struct can be

freed by vc_deallocate(). Because of that, the struct vc_data pointer

load must be done at the top of while loop in vcs_read() to avoid a UAF

when vcs_size() is called.

Syzkaller reported a UAF in vcs_size().

BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215)

Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537

CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1

Hardware name: Red Hat KVM, BIOS 1.15.0-2.module

Call Trace:

<TASK>

__asan_report_load4_noabort (mm/kasan/report_generic.c:350)

vcs_size (drivers/tty/vt/vc_screen.c:215)

vcs_read (drivers/tty/vt/vc_screen.c:415)

vfs_read (fs/read_write.c:468 fs/read_write.c:450)

...

</TASK>

Allocated by task 1191:

...

kmalloc_trace (mm/slab_common.c:1069)

vc_allocate (./inclu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References