In the Linux kernel, the following vulnerability has been resolved:
video: fbdev: s3fb: Check the size of screen before memset_io()
In the function s3fbsetpar(), the value of 'screensize' is calculated by the user input. If the user provides the improper value, the value of 'screensize' may larger than 'info->screen_size', which may cause the following bug:
[ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: errorcode(0x0002) - not-present page [ 54.083760] RIP: 0010:memsetorig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fbsetpar+0x1ec6/0x4040 [ 54.083806] fbsetvar+0x604/0xeb0 [ 54.083836] dofbioctl+0x234/0x670
Fix the this by checking the value of 'screensize' before memsetio().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eacb50f1733660911827d7c3720f4c5425d0cdda",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-2526c77f",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce50d94afcb8690813c5522f24cd38737657db81",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-31e03b9d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d7cacc6a2a1d77e7e20a492daf458a12cf19e0",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-38d72169",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0da18956d38e7106664dc1d06367b22f06edd3",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-440eaed0",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce50d94afcb8690813c5522f24cd38737657db81",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-469a20e3",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52461d387cc8c8f8dc40320caa2e9e101f73e7ba",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-60be1e11",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c35a0dc2b4e7acf24c796043b64fa3eee799239",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-6722c7b8",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c35a0dc2b4e7acf24c796043b64fa3eee799239",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-7603de7c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba592fa014f21f35a8ee8da4ca7b95a018f13e8",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-79cbce8d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@574912261528589012b61f82d368256247c3a5a8",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-83b9bcd9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e0da18956d38e7106664dc1d06367b22f06edd3",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-d5b94355",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eacb50f1733660911827d7c3720f4c5425d0cdda",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-e1a8faf3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52461d387cc8c8f8dc40320caa2e9e101f73e7ba",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-e8204c48",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@574912261528589012b61f82d368256247c3a5a8",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-f1aab628",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba592fa014f21f35a8ee8da4ca7b95a018f13e8",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "s3fb_set_par",
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-f6fc9310",
"digest": {
"length": 9427.0,
"function_hash": "224268781346102457702930067432540670145"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d7cacc6a2a1d77e7e20a492daf458a12cf19e0",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/s3fb.c"
},
"id": "CVE-2022-50097-fc70b416",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249801334651227442334209141249605693105",
"273769969232100954472998455989480675245",
"63057032926397586536966979366770634213"
]
},
"signature_type": "Line"
}
]