PT-2024-11379 · Linux+6 · Linux Kernel+6
Published
2021-06-28
·
Updated
2025-12-10
·
CVE-2021-47383
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue occurs when a userspace program performs an ioctl FBIOPUT VSCREENINFO, passing a
fb var screeninfo struct with only xres, yres, and bits per pixel fields, and their values. If this struct is the same as the previous ioctl, vc resize() detects it and doesn't call resize screen(), leaving fb var screeninfo incomplete. This leads to updatescrollmode() calculating a wrong value for fbcon display->vrows, causing real y() to return an incorrect value of y. This incorrect value eventually causes imageblit to access an out-of-bound address.Recommendations
To solve this issue, the
resize screen() function is called even if the screen does not need resizing, ensuring fb var screeninfo is "fixed and filled" independently.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linux Kernel
Red Hat
Rocky Linux
Suse