In the Linux kernel, the following vulnerability has been resolved:
vt: Clear selection before changing the font
When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vcdoresize().
Prevent such out-of-memory accesses by dropping the selection before the various confontset() console handlers are called.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@989201bb8c00b222235aff04e6200230d29dc7bb", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-00eeae9a" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f74b4a41c5d7c9522469917e3072e55d435efd9e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-0d7ee6da" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2535431ae967ad17585513649625fea7db28d4db", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-140a8d50" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9ba4611ddf676194385506222cce7b0844e708e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-1dc28c4a" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9ba4611ddf676194385506222cce7b0844e708e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "238552280624355046698182584831989809428" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-26f5be20" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cf1930369c9dc428d827b60260c53271bff3285", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-2e24a436" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-5540d1bd" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f9c9f89337792070b5a6062dff448b3e7977f", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-63737112" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-885edf2f" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@989201bb8c00b222235aff04e6200230d29dc7bb", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-8b975d63" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-8ca8a7f9" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f74b4a41c5d7c9522469917e3072e55d435efd9e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-8e9d9a83" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@989201bb8c00b222235aff04e6200230d29dc7bb", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-93e5a30f" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f74b4a41c5d7c9522469917e3072e55d435efd9e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-95cd391b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9ba4611ddf676194385506222cce7b0844e708e", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-aac5032b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2535431ae967ad17585513649625fea7db28d4db", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-b521f2d0" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cf1930369c9dc428d827b60260c53271bff3285", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "line_hashes": [ "239567734012173771032987539036023543123", "9674188445103087056847746604357965773", "302408984029207143488920030059231238822", "5152856774045875097109804292509907546", "78024341658319312991460006562785173958", "188602595031685882349431045212470954676", "228154402705448403438048700106859083794", "151861813308678686800005132072074833674", "78709527326858784464379951551072750118", "229549623323686066886854710354974310707", "159290521745754380706282222300190785005", "125634486604077567521737509605465926185" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-49948-c0e571dc" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cf1930369c9dc428d827b60260c53271bff3285", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-d0ab1de1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2535431ae967ad17585513649625fea7db28d4db", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-d52f093e" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f9c9f89337792070b5a6062dff448b3e7977f", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_set" }, "digest": { "length": 936.0, "function_hash": "29111218421720035037503633989123125947" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-e708d833" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566f9c9f89337792070b5a6062dff448b3e7977f", "signature_version": "v1", "target": { "file": "drivers/tty/vt/vt.c", "function": "con_font_default" }, "digest": { "length": 664.0, "function_hash": "305267498230216431387081655079894615426" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-49948-eba17ed7" } ]