CVE-2021-47383

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47383
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 Patch
https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c Patch
https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b Patch
https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b Patch
https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f Patch
https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a Patch
https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 Patch
https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 Patch
https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 Patch
https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c Patch
https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b Patch
https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b Patch
https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f Patch
https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a Patch
https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 Patch
https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Sep 2025, 20:14

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
References () https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 - () https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 - Patch
References () https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c - () https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c - Patch
References () https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b - () https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b - Patch
References () https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b - () https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b - Patch
References () https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f - () https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f - Patch
References () https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a - () https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a - Patch
References () https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 - () https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 - Patch
References () https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 - () https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-125
First Time Linux
Linux linux Kernel

21 Nov 2024, 06:36

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tty: corrige el acceso vmalloc fuera de los límites en imageblit. Este problema ocurre cuando un programa de espacio de usuario realiza un ioctl FBIOPUT_VSCREENINFO pasando la estructura fb_var_screeninfo que contiene solo los campos xres, yres y bits_per_pixel con valores. Si esta estructura es la misma que la ioctl anterior, vc_resize() la detecta y no llama a resize_screen(), dejando fb_var_screeninfo incompleto. Y esto lleva a que updatecrollmode() calcule un valor incorrecto para fbcon_display->vrows, lo que hace que real_y() devuelva un valor incorrecto de y, y ese valor, eventualmente, hace que imageblit acceda a un valor de dirección fuera de los límites. . Para resolver este problema, hice que se llamara a resize_screen() incluso si la pantalla no necesita ningún cambio de tamaño, por lo que "arreglará y completará" fb_var_screeninfo de forma independiente.
References () https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 - () https://git.kernel.org/stable/c/067c694d06040db6f0c65281bb358452ca6d85b9 -
References () https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c - () https://git.kernel.org/stable/c/3b0c406124719b625b1aba431659f5cdc24a982c -
References () https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b - () https://git.kernel.org/stable/c/699d926585daa6ec44be556cdc1ab89e5d54557b -
References () https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b - () https://git.kernel.org/stable/c/70aed03b1d5a5df974f456cdc8eedb213c94bb8b -
References () https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f - () https://git.kernel.org/stable/c/7e71fcedfda6f7de18f850a6b36e78d78b04476f -
References () https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a - () https://git.kernel.org/stable/c/883f7897a25e3ce14a7f274ca4c73f49ac84002a -
References () https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 - () https://git.kernel.org/stable/c/8a6a240f52e14356386030d8958ae8b1761d2325 -
References () https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 - () https://git.kernel.org/stable/c/d570c48dd37dbe8fc6875d4461d01a9554ae2560 -

21 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 15:15

Updated : 2025-09-23 20:14

NVD link : CVE-2021-47383

Mitre link : CVE-2021-47383

CVE.ORG link : CVE-2021-47383

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read