In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fbdev: bitblit: bound-check glyph index in bit_cursor()<\/p>\n
bit_cursor() fetches the glyph under the cursor with<\/p>\n
\tc = scr_readw(vc_pos);
\n\tsrc = vc_font.data + ((c & charmask) * w * height);<\/p>\n
where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
\nvalue comes directly from scr_readw() and may be larger than the current
\nfont’s glyph count.<\/p>\n
Syzkaller triggers this via vcs_write(). The Call Trace shows
\nvcs_write() in vc_screen.c writing an arbitrary 16-bit value with
\nwritev() to \/dev\/vcsa, which vcs_write_buf() in vc_screen.c stores via
\nvcs_scr_writew() without checking charcount. The stored value is later
\nread in bit_cursor() in bitblit.c.<\/p>\n
When the font is changed from a font with 512 glyphs to a font with
\n256 glyphs, the screen buffer can retain characters with the high
\nbit set from the previous mode, which could also produce the same
\nout-of-bounds access.<\/p>\n
BUG: KASAN: global-out-of-bounds in soft_cursor+0x378\/0x6bc drivers\/video\/fbdev\/core\/softcursor.c:70
\n Read of size 16 at addr ffff800086c57970<\/p>\n
Call Trace:
\n soft_cursor+0x378\/0x6bc drivers\/video\/fbdev\/core\/softcursor.c:70
\n bit_cursor+0xa90\/0x1108 drivers\/video\/fbdev\/core\/bitblit.c:365
\n fbcon_cursor+0x344\/0x498 drivers\/video\/fbdev\/core\/fbcon.c:1427
\n hide_cursor+0xdc\/0x2d0 drivers\/tty\/vt\/vt.c:883
\n update_region+0x100\/0x18c drivers\/tty\/vt\/vt.c:669
\n vcs_write+0x8ec\/0xaf0 drivers\/tty\/vt\/vc_screen.c:685<\/p>\n
bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
\nindex to vc_font.charcount. Apply the same clamp in bit_cursor() after
\nextracting the attribute and masking, before indexing fontdata.<\/p>\n
The fix completes the bounds checking started in commit 18c4ef4e765a
\n(“fbdev: bitblit: bound-check glyph index in bit_putcs*”), which missed
\nthe cursor path.<\/p>\n
This change should be safe because the clamp reuses the existing
\ncontract from fbcon: charcount is maintained under console_lock in
\ncon_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
\nswitching from 512 to 256 glyphs. When stale screen data with high bits
\nremains after a font switch, or when vcs_write() stores an arbitrary
\nvalue, clamping the index to 0 prevents the out-of-bounds read without
\nchanging cursor semantics \u2014 the same fallback bit_putcs uses.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fbdev: bitblit: bound-check glyph index in bit_cursor()<\/p>\n
bit_cursor() fetches the glyph under the cursor with<\/p>\n
\tc = scr_readw(vc_po<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11235","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}