In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF<\/p>\n
The reload of ‘vc’ added by commit 8fb9ea65c9d1 (“vc_screen: reload load
\nof struct vc_data pointer in vcs_write() to avoid UAF”) sits after the
\n‘if (ret)’ block, so the copy-failure break path exits the loop without
\nreloading vc. If the vc was kfree()’d via vc_port_destruct during the
\nunlocked copy_from_user() window, the post-loop
\n‘if (written && vc) vcs_scr_updated(vc)’ is reached with a stale
\nnon-NULL vc. The ‘&& vc’ guard from commit a287620312dc (“vc_screen:
\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write”) only
\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then
\nreads param->vc->vc_num from freed memory:<\/p>\n
BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c\/0xd0
\n Read of size 2 at addr ffff888007149190
\n Call Trace:
\n vcs_notifier+0x7c\/0xd0
\n atomic_notifier_call_chain+0x70\/0xa0
\n vcs_scr_updated+0x77\/0xa0
\n vcs_write+0x71b\/0x7e0
\n Allocated by task: vc_allocate -> con_install -> tty_open
\n Freed by task: kfree vc_port_destruct)<\/p>\n
Move the reload to immediately after console_lock(), before ‘if (ret)’,
\nso every break path below passes a fresh vc to the post-loop
\nvcs_scr_updated().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF<\/p>\n
The reload of ‘vc’ added by commit 8fb9ea65c9d1 (“vc_scre<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41312","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}