In the Linux kernel, the following vulnerability has been resolved:
video: fbdev: arkfb: Check the size of screen before memset_io()
In the function arkfbsetpar(), the value of 'screensize' is calculated by the user input. If the user provides the improper value, the value of 'screensize' may larger than 'info->screen_size', which may cause the following bug:
[ 659.399066] BUG: unable to handle page fault for address: ffffc90003000000 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: errorcode(0x0002) - not-present page [ 659.399094] RIP: 0010:memsetorig+0x33/0xb0 [ 659.399116] Call Trace: [ 659.399122] arkfbsetpar+0x143f/0x24c0 [ 659.399130] fbsetvar+0x604/0xeb0 [ 659.399161] dofbioctl+0x234/0x670 [ 659.399189] fb_ioctl+0xdd/0x130
Fix the this by checking the value of 'screensize' before memsetio().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ce61c39c2a0b8ec82f48e0f7136f0dac105ae75",
"id": "CVE-2022-50099-07f3b6d1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96b550971c65d54d64728d8ba973487878a06454",
"id": "CVE-2022-50099-19fcf874",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bcb1a06e3091716b7cbebe0e91d1de9895068cd",
"id": "CVE-2022-50099-1d9d833e",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bcb1a06e3091716b7cbebe0e91d1de9895068cd",
"id": "CVE-2022-50099-31a6348e",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09e733d6ac948e6fda4b16252e44ea46f98fc8b4",
"id": "CVE-2022-50099-35782013",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53198b81930e567ad6b879812d88052a1e8ac79e",
"id": "CVE-2022-50099-3ff11d02",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09e733d6ac948e6fda4b16252e44ea46f98fc8b4",
"id": "CVE-2022-50099-54dc48e8",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96b550971c65d54d64728d8ba973487878a06454",
"id": "CVE-2022-50099-56d5ae68",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0701df594bc1d7ae55fed407fb65dd90a93f8a9c",
"id": "CVE-2022-50099-57ac451c",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a20c5510aa2c031a096a58deb356e91609781c9",
"id": "CVE-2022-50099-5d6963f1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@352305ea50d682b8e081d826da53caf9e744d7d0",
"id": "CVE-2022-50099-6a1f937f",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ce61c39c2a0b8ec82f48e0f7136f0dac105ae75",
"id": "CVE-2022-50099-760f6f65",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53198b81930e567ad6b879812d88052a1e8ac79e",
"id": "CVE-2022-50099-894cf6eb",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72692723525587975390592611094218525125",
"245843723740328967555144228794814355058",
"245395417304907728875269532155088489960"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@352305ea50d682b8e081d826da53caf9e744d7d0",
"id": "CVE-2022-50099-9f709434",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0701df594bc1d7ae55fed407fb65dd90a93f8a9c",
"id": "CVE-2022-50099-caadaa8c",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a20c5510aa2c031a096a58deb356e91609781c9",
"id": "CVE-2022-50099-ddbb2251",
"deprecated": false,
"target": {
"function": "arkfb_set_par",
"file": "drivers/video/fbdev/arkfb.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 5648.0,
"function_hash": "261464732961178448773129816839534713504"
}
}
]