CVE-2021-47383

What it actually does

The vulnerability allows an out-of-bounds vmalloc access in the imageblit function due to incorrect calculation of fbcon_display->vrows from an incomplete fb_var_screeninfo struct after an ioctl FBIOPUT_VSCREENINFO that matches the previous state, skipping resize_screen().

Why it matters to the business

Systems running affected Linux kernels with framebuffer console enabled may experience kernel panics or potential privilege escalation, impacting stability of servers, embedded devices, and Android systems.

How an attack unfolds

An attacker with access to a userspace program can issue a sequence of FBIOPUT_VSCREENINFO ioctls with partial fields to trigger the condition where updatescrollmode() computes wrong vrows, leading to real_y() returning invalid y and imageblit accessing out-of-bound memory. Threat actors targeting Android kernel could leverage this for remote code execution.

How to fix it

Apply the kernel patch that ensures resize_screen() is called even when no resizing is needed to properly initialize fb_var_screeninfo. Update to a fixed kernel version that resolves the vc_resize path.

How to confirm the fix worked

Verify kernel source includes the fix for calling resize_screen() unconditionally in vc_resize() path, or test with the described ioctl sequence to ensure no OOB access occurs.

Typical attack path

1. Identify system with framebuffer console enabled
2. Craft ioctl call with specific xres yres bits_per_pixel matching previous state
3. Trigger fbcon operations that invoke imageblit via updatescrollmode and real_y
4. Achieve OOB vmalloc access for crash or code execution

How to detect it

Look for kernel logs indicating out-of-bounds access in imageblit or fbcon, unusual sequences of FBIOPUT_VSCREENINFO ioctls on tty devices, and Android kernel crash artifacts.

What your security team should do

• Prioritize kernel updates on systems using fbcon
• Monitor for kernel oops related to imageblit or fbcon
• Restrict unprivileged access to framebuffer devices where feasible