CVE-2024-26798

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbcon: always restore the old font data in fbcon_do_set_font()

Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when

vc_resize() failed) started restoring old font data upon failure (of

vc_resize()). But it performs so only for user fonts. It means that the

"system"/internal fonts are not restored at all. So in result, the very

first call to fbcon_do_set_font() performs no restore at all upon

failing vc_resize().

This can be reproduced by Syzkaller to crash the system on the next

invocation of font_get(). It's rather hard to hit the allocation failure

in vc_resize() on the first font_set(), but not impossible. Esp. if

fault injection is used to aid the execution/failure. It was

demonstrated by Sirius:

BUG: unable to handle page fault for address: fffffffffffffff8

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0

Oops: 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References