In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vt: skip screen update for DEC alignment test on backgroup consoles<\/p>\n
[BUG]
\nRecently, we encountered a KASAN warning as follows:<\/p>\n
BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f\/0x140
\nRead of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob\/1239
\nCPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)
\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04\/01\/2014
\nCall Trace:<\/p>\n
…
\n kasan_report+0xf0\/0x120
\n fb_pad_aligned_buffer+0x11f\/0x140
\n ccw_putcs+0x86c\/0xa80
\n fbcon_putcs+0x338\/0x410
\n do_update_region+0x21d\/0x450
\n do_con_write+0x1e0e\/0x4880
\n con_write+0x13\/0x80
\n n_tty_write+0x374\/0x1010
\n file_tty_write.isra.0+0x404\/0x7a0
\n …<\/p>\n
reproduce:
\n1) open \/dev\/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
\nop.width = 8 and op.height = 16 (visible VC1)
\n2) open \/dev\/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
\nop.width = 28 and op.height = 24 (invisible VC2)
\n3) echo 3 > \/sys\/devices\/virtual\/graphics\/fbcon\/rotate_all
\n4) write EShash8(esc hash8) to tty1<\/p>\n
[CAUSE]
\nAll VCs render to the framebuffer. setfont only modifies the target VC’s
\nfont without resizing the framebuffer backing buffer (par->rotated.buf);
\nthe buffer is only resized for the visible VC
\n(fbcon_do_set_font -> … -> vc_do_resize -> update_screen). This relies on
\nthe con_should_update() check performed before every update_region().<\/p>\n
However, the ESC # 8 path (do_con_trol -> do_update_region) omits the
\ncon_should_update() check. After changing the font size of an invisible VC,
\ndo_update_region() fills using the new font size against a buffer that was
\nnever resized, causing an out-of-bounds access.<\/p>\n
[FIX]
\nOnly push the update when the console is visible and not blanked, add
\nthe con_should_update() check in the do_con_trol() like every other call
\nsite of do_update_region() (update_region(), invert_screen(), …).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vt: skip screen update for DEC alignment test on backgroup consoles<\/p>\n
[BUG]
\nRecently, we encountered a KASAN warning as follows:<\/p>\n
BU<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41310","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}