CVE-2021-47383
tty: Fix out-of-bound vmalloc access in imageblit
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl
FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct
containing only the fields xres, yres, and bits_per_pixel
with values. If this struct is the same as the previous ioctl, the
vc_resize() detects it and doesn't call the resize_screen(),
leaving the fb_var_screeninfo incomplete. And this leads to
the updatescrollmode() calculates a wrong value to
fbcon_display->vrows, which makes the real_y() return a
wrong value of y, and that value, eventually, causes
the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called
even if the screen does not need any resizing, so it will
"fix and fill" the fb_var_screeninfo independently.
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tty: corrige el acceso vmalloc fuera de los límites en imageblit. Este problema ocurre cuando un programa de espacio de usuario realiza un ioctl FBIOPUT_VSCREENINFO pasando la estructura fb_var_screeninfo que contiene solo los campos xres, yres y bits_per_pixel con valores. Si esta estructura es la misma que la ioctl anterior, vc_resize() la detecta y no llama a resize_screen(), dejando fb_var_screeninfo incompleto. Y esto lleva a que updatecrollmode() calcule un valor incorrecto para fbcon_display->vrows, lo que hace que real_y() devuelva un valor incorrecto de y, y ese valor, eventualmente, hace que imageblit acceda a un valor de dirección fuera de los límites. . Para resolver este problema, hice que se llamara a resize_screen() incluso si la pantalla no necesita ningún cambio de tamaño, por lo que "arreglará y completará" fb_var_screeninfo de forma independiente.
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
This update for the Linux Kernel 5.3.18-150300_59_153 fixes several issues. The following security issues were fixed. Fixed potential UAF in cifs_signal_cifsd_for_reconnect. Ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions. Hfsplus: fix uninit-value in copy_name. Fs/9p: only translate RWX permissions for plain 9P2000. Protect fl_walk with rcu Destroy cm id before destroy qp to avoid use after free. Fixed use-after-free bugs caused by sco_sock_timeout. Drm/client: Fully protect modes with dev->mode_config.mutex. Fixed out-of-bound vmalloc access in imageblit. Fixed false-positive lockdep splat for spin_lock in __unix_gc. Fixed underflow in parse_server_interfaces. Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets. Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules. Fixed use-after-free in ip6_route_mpath_notify. Fixed memory corruption in wifi/iwlwifi. Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header. Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation. Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_genericon the socket that the SKB is queued on. Fixed a use-after-free vulnerability in the control index filter.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-05-21 CVE Reserved
- 2024-05-21 CVE Published
- 2025-05-04 CVE Updated
- 2025-08-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (10)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2021-47383 | 2024-10-30 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2282357 | 2024-10-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 4.4.286 Search vendor "Linux" for product "Linux Kernel" and version " < 4.4.286" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 4.9.285 Search vendor "Linux" for product "Linux Kernel" and version " < 4.9.285" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 4.14.249 Search vendor "Linux" for product "Linux Kernel" and version " < 4.14.249" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 4.19.209 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.209" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 5.4.151 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.151" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 5.10.71 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.71" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 5.14.10 Search vendor "Linux" for product "Linux Kernel" and version " < 5.14.10" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 5.15 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15" | en |
Affected
|