| Description: | In the Linux kernel, the following vulnerability has been resolved:
tty: Fix out-of-bound vmalloc access in imageblit This issue happens
when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the
fb_var_screeninfo struct containing only the fields xres, yres, and
bits_per_pixel with values. If this struct is the same as the previous
ioctl, the vc_resize() detects it and doesn't call the
resize_screen(), leaving the fb_var_screeninfo incomplete. And this
leads to the updatescrollmode() calculates a wrong value to
fbcon_display->vrows, which makes the real_y() return a wrong value of
y, and that value, eventually, causes the imageblit to access an out-
of-bound address value. To solve this issue I made the resize_screen()
be called even if the screen does not need any resizing, so it will
"fix and fill" the fb_var_screeninfo independently.
|
