In the Linux kernel, the following vulnerability has been resolved:
vcscreen: move load of struct vcdata pointer in vcs_read() to avoid UAF
After a call to consoleunlock() in vcsread() the vcdata struct can be freed by vcdeallocate(). Because of that, the struct vcdata pointer load must be done at the top of while loop in vcsread() to avoid a UAF when vcs_size() is called.
Syzkaller reported a UAF in vcs_size().
BUG: KASAN: use-after-free in vcssize (drivers/tty/vt/vcscreen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537
CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: <TASK> _asanreportload4noabort (mm/kasan/reportgeneric.c:350) vcssize (drivers/tty/vt/vcscreen.c:215) vcsread (drivers/tty/vt/vcscreen.c:415) vfsread (fs/readwrite.c:468 fs/readwrite.c:450) ... </TASK>
Allocated by task 1191: ... kmalloctrace (mm/slabcommon.c:1069) vcallocate (./include/linux/slab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) coninstall (drivers/tty/vt/vt.c:3383) ttyinitdev (drivers/tty/ttyio.c:1301 drivers/tty/ttyio.c:1413 drivers/tty/ttyio.c:1390) ttyopen (drivers/tty/ttyio.c:2080 drivers/tty/ttyio.c:2126) chrdevopen (fs/chardev.c:415) dodentryopen (fs/open.c:883) vfs_open (fs/open.c:1014) ...
Freed by task 1548: ... kfree (mm/slabcommon.c:1021) vcportdestruct (drivers/tty/vt/vt.c:1094) ttyportdestructor (drivers/tty/ttyport.c:296) ttyportput (drivers/tty/ttyport.c:312) vtdisallocateall (drivers/tty/vt/vtioctl.c:662 (discriminator 2)) vtioctl (drivers/tty/vt/vtioctl.c:903) ttyioctl (drivers/tty/ttyio.c:2776) ...
The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of 1024-byte region [ffff888113747800, ffff888113747c00)
The buggy address belongs to the physical page: page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113740 head:00000000b3fe6c7c order:3 compoundmapcount:0 subpagesmapcount:0 compound_pincount:0 anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Disabling lock debugging due to kernel taint
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af79ea9a2443016f64d8fd8d72020cc874f0e066",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-0fbf8c63",
        "signature_type": "Function",
        "digest": {
            "length": 2382.0,
            "function_hash": "7754406319548979878544832362982893414"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55515d7d8743b71b80bfe68e89eb9d92630626ab",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-545edfb4",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "243440358597151705327062895098947913115",
                "93092893634207122110420230710648827630",
                "327726454805479845154630459061723345015"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0332cbf53dad06a22189cc341391237f4ea6d9f",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-572a170c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "194669052187204175825133086557578020615",
                "225833385706291538366459260935121575471",
                "93598262495117319812618579977554497654"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@226fae124b2dac217ea5436060d623ff3385bc34",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-89666554",
        "signature_type": "Function",
        "digest": {
            "length": 1485.0,
            "function_hash": "82267858843667678153217484873393978710"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@226fae124b2dac217ea5436060d623ff3385bc34",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-8d20300e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "243440358597151705327062895098947913115",
                "93092893634207122110420230710648827630",
                "327726454805479845154630459061723345015"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0332cbf53dad06a22189cc341391237f4ea6d9f",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-9a277a76",
        "signature_type": "Function",
        "digest": {
            "length": 2771.0,
            "function_hash": "5658784523445116296388076806818360103"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6332f52f44b9776568bf3c0b714ddfb0bb175e78",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-9a8c683a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "194669052187204175825133086557578020615",
                "225833385706291538366459260935121575471",
                "93598262495117319812618579977554497654"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc9e27f3ba083534b8bbf72ab0f5c810ffdc7d18",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-b04012c3",
        "signature_type": "Function",
        "digest": {
            "length": 1485.0,
            "function_hash": "82267858843667678153217484873393978710"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af79ea9a2443016f64d8fd8d72020cc874f0e066",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-bd24637b",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "227202116361817811524359263113003645365",
                "38627498376214207308617405207709005304",
                "41375338935763398152868508773306905142",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "194669052187204175825133086557578020615",
                "225833385706291538366459260935121575471",
                "93598262495117319812618579977554497654"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8506f16aae9daf354e3732bcfd447e2a97f023df",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-be79e58e",
        "signature_type": "Function",
        "digest": {
            "length": 1485.0,
            "function_hash": "82267858843667678153217484873393978710"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc9e27f3ba083534b8bbf72ab0f5c810ffdc7d18",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-cf9f94c7",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "243440358597151705327062895098947913115",
                "93092893634207122110420230710648827630",
                "327726454805479845154630459061723345015"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8506f16aae9daf354e3732bcfd447e2a97f023df",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-e7f2d9a9",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10759863151621071318869558372902587042",
                "284658742615349076329022146872301356612",
                "158483265662843620380987414579699721168",
                "53992494608108148549741711364119249229",
                "243512168418846053700272100162269820467",
                "88891978062567852138856054809743016338",
                "85761572863570243838054194407081230346",
                "243440358597151705327062895098947913115",
                "93092893634207122110420230710648827630",
                "327726454805479845154630459061723345015"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55515d7d8743b71b80bfe68e89eb9d92630626ab",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-ebe57f35",
        "signature_type": "Function",
        "digest": {
            "length": 1485.0,
            "function_hash": "82267858843667678153217484873393978710"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6332f52f44b9776568bf3c0b714ddfb0bb175e78",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "vcs_read",
            "file": "drivers/tty/vt/vc_screen.c"
        },
        "id": "CVE-2023-52973-f0349cd4",
        "signature_type": "Function",
        "digest": {
            "length": 2763.0,
            "function_hash": "118316486591319145020689936769951209345"
        }
    }
]