In the Linux kernel, the following vulnerability has been resolved:
lib/fonts: fix undefined behavior in bit shift for getdefaultfont
Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20 left shift of 1 by 31 places cannot be represented in type 'int' <TASK> dumpstacklvl+0x7d/0xa5 dumpstack+0x15/0x1b ubsanepilogue+0xe/0x4e _ubsanhandleshiftoutofbounds+0x1e7/0x20c getdefaultfont+0x1c7/0x1f0 fbconstartup+0x347/0x3a0 dotakeoverconsole+0xce/0x270 dofbcontakeover+0xa1/0x170 dofbregistered+0x2a8/0x340 fbconfbregistered+0x47/0xe0 registerframebuffer+0x294/0x4a0 _drmfbhelperinitialconfigandunlock+0x43c/0x880 [drmkmshelper] drmfbhelperinitialconfig+0x52/0x80 [drmkmshelper] drmfbdevclienthotplug+0x156/0x1b0 [drmkmshelper] drmfbdevgenericsetup+0xfc/0x290 [drmkmshelper] bochspciprobe+0x6ca/0x772 [bochs] localpciprobe+0x4d/0xb0 pcideviceprobe+0x119/0x320 reallyprobe+0x181/0x550 _driverprobedevice+0xc6/0x220 driverprobedevice+0x32/0x100 _driverattach+0x195/0x200 busforeachdev+0xbb/0x120 driverattach+0x27/0x30 busadddriver+0x22e/0x2f0 driverregister+0xa9/0x190 _pciregisterdriver+0x90/0xa0 bochspcidriverinit+0x52/0x1000 [bochs] dooneinitcall+0x76/0x430 doinitmodule+0x61/0x28a loadmodule+0x1f82/0x2e50 _dosysfinitmodule+0xf8/0x190 _x64sysfinitmodule+0x23/0x30 dosyscall64+0x58/0x80 entrySYSCALL64afterhwframe+0x63/0xcd </TASK>
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e83b47580a0738361772d6f24286adfdaba57e36",
"signature_version": "v1",
"id": "CVE-2022-50511-24ff62e4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fe888c4d2fb174408e4540bb2d5602b9f507f90",
"signature_version": "v1",
"id": "CVE-2022-50511-65080790",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c14a85e18a58c102ec223144b7edb5b345c1bea",
"signature_version": "v1",
"id": "CVE-2022-50511-a6473fce",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9a9aa02f0fa3318e0ae5774f404419a1b4759ca",
"signature_version": "v1",
"id": "CVE-2022-50511-adaf9543",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e039929e36818507e90901edae87f6fa8bc81093",
"signature_version": "v1",
"id": "CVE-2022-50511-c20bddf6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e039929e36818507e90901edae87f6fa8bc81093",
"signature_version": "v1",
"id": "CVE-2022-50511-d3cbff50",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890d91b31f4874361e0df047f57d268a7021cb12",
"signature_version": "v1",
"id": "CVE-2022-50511-d8887b10",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fe888c4d2fb174408e4540bb2d5602b9f507f90",
"signature_version": "v1",
"id": "CVE-2022-50511-e4dfd6f4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c14a85e18a58c102ec223144b7edb5b345c1bea",
"signature_version": "v1",
"id": "CVE-2022-50511-ec636697",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890d91b31f4874361e0df047f57d268a7021cb12",
"signature_version": "v1",
"id": "CVE-2022-50511-edaa0b50",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e83b47580a0738361772d6f24286adfdaba57e36",
"signature_version": "v1",
"id": "CVE-2022-50511-ef1f3be5",
"signature_type": "Function",
"digest": {
"function_hash": "295656218830461334353199619495543309211",
"length": 835.0
},
"deprecated": false,
"target": {
"function": "get_default_font",
"file": "lib/fonts/fonts.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9a9aa02f0fa3318e0ae5774f404419a1b4759ca",
"signature_version": "v1",
"id": "CVE-2022-50511-fe7f2b9d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"18681430281369575830377266682726346646",
"106553705026458947722401830413492171057",
"54492991833956024231189279182521312692",
"80031224385945371254918771543330683554",
"46978912622045838122737938121078729162"
]
},
"deprecated": false,
"target": {
"file": "lib/fonts/fonts.c"
}
}
]