CVE-2021-33655

What it actually does

Out-of-bounds memory write in the Linux kernel framebuffer handling code triggered by malicious data supplied to the FBIOPUT_VSCREENINFO ioctl.

Why it matters to the business

Local attackers with administrative privileges on affected Linux systems can corrupt kernel memory, leading to crashes, data corruption, or potential privilege escalation that disrupts operations and compromises system integrity.

How an attack unfolds

An attacker with root or equivalent local access crafts a malicious ioctl payload targeting the framebuffer device and issues FBIOPUT_VSCREENINFO to trigger an out-of-bounds write, enabling further kernel memory manipulation.

How to fix it

Upgrade the Linux kernel to a version containing commit 086ff84617185393a0bbf25830c4f36412a7d3f4 or later that resolves the out-of-bounds write in the ioctl handler.

How to confirm the fix worked

Verify the running kernel contains commit 086ff84617185393a0bbf25830c4f36412a7d3f4 or a backported equivalent; test that crafted FBIOPUT_VSCREENINFO ioctls no longer cause out-of-bounds writes.

Typical attack path

1. Obtain local shell access with high privileges on a vulnerable Linux system
2. Locate and open a framebuffer device node
3. Construct malicious data structure for FBIOPUT_VSCREENINFO
4. Invoke the ioctl to trigger the out-of-bounds write
5. Leverage resulting memory corruption for further exploitation

How to detect it

Review kernel audit logs and dmesg for ioctl calls involving FBIOPUT_VSCREENINFO with abnormal parameters; inspect system call traces from privileged processes accessing framebuffer devices.

• FBIOPUT_VSCREENINFO
• ioctl.*FBIOPUT_VSCREENINFO

What your security team should do

• Apply the kernel fix containing commit 086ff84617185393a0bbf25830c4f36412a7d3f4 as soon as possible
• Restrict unprivileged access to framebuffer devices via device permissions or SELinux/AppArmor policies
• Monitor kernel audit logs for unusual ioctl activity on framebuffer devices