CVE-2021-47383
Description
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| debian | bookworm | fixed | 5.14.12-1 |
| debian | bullseye | fixed | 5.10.84-1 |
| debian | forky | fixed | 5.14.12-1 |
| debian | sid | fixed | 5.14.12-1 |
| debian | trixie | fixed | 5.14.12-1 |
| rocky | 9 | fixed | |
| almalinux | 9 | fixed | kernel-64k-devel-matched-5.14.0-427.42.1.el9_4.aarch64.rpm |
References
- https://access.redhat.com/errata/RHSA-2024:8617
- https://errata.rockylinux.org/RLSA-2024:7000
- https://errata.rockylinux.org/RLSA-2024:7001
- https://www.suse.com/security/cve/CVE-2021-47383.html
- https://security-tracker.debian.org/tracker/CVE-2021-47383
- https://errata.rockylinux.org/RLSA-2024:8617
- https://bugzilla.redhat.com/2268118
- https://bugzilla.redhat.com/2270100
- https://bugzilla.redhat.com/2275604
- https://bugzilla.redhat.com/2277171
- https://bugzilla.redhat.com/2278176
- https://bugzilla.redhat.com/2278235
- https://bugzilla.redhat.com/2282357
- https://bugzilla.redhat.com/2293654
- https://bugzilla.redhat.com/2296067
- https://bugzilla.redhat.com/2297476
- https://bugzilla.redhat.com/2297488
- https://bugzilla.redhat.com/2297515
- https://bugzilla.redhat.com/2297544
- https://bugzilla.redhat.com/2297556
- https://bugzilla.redhat.com/2297561
- https://bugzilla.redhat.com/2297579
- https://bugzilla.redhat.com/2297582
- https://bugzilla.redhat.com/2297589
- https://bugzilla.redhat.com/2300296
💬 Discuss CVE-2021-47383 on VIR Community →
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.