CVE-2022-2380

What it actually does

Out-of-bounds memory access in smtcfb_read() within the sm712fb framebuffer driver allows a local process to read past allocated buffers, resulting in a kernel panic.

Why it matters to the business

Local users on affected Linux systems can trigger denial-of-service crashes, interrupting workloads that rely on the sm712 framebuffer without requiring network access or elevated privileges.

How an attack unfolds

An attacker with local shell access crafts input that invokes smtcfb_read() on a device backed by the sm712 driver, causing the kernel to access memory outside the intended buffer and panic the system.

How to fix it

Update the Linux kernel to the commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f or later; rebuild and deploy the patched kernel image across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f via git log or kernel version string; attempt to load the sm712fb module and exercise smtcfb_read() under memory debugging tools such as KASAN to verify absence of out-of-bounds access.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Open or mmap the framebuffer device associated with sm712 hardware
3. Issue read operations that trigger smtcfb_read() with parameters exceeding buffer bounds
4. Observe kernel oops and system crash or reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing sm712fb.c or smtcfb_read; correlate with user processes that opened /dev/fb* devices around the crash timestamp.

• smtcfb_read
• sm712fb.c
• fbdev/sm712fb

What your security team should do

• Prioritize patching systems that expose the sm712 framebuffer driver to untrusted local users
• Restrict framebuffer device access via udev rules or group permissions until patched
• Monitor kernel crash logs for sm712fb-related oops entries during the patching window