CVE-2022-48993
NoneCVSS
—
EPSS
—
Published
Oct 21, 2024
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel could let leftover memory get copied into the screen display area, which might make systems unstable or leak information until fixed kernels are installed.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
The flaw stems from fbcon_prepare_logo() allocating a buffer with kmalloc() rather than kzalloc(), leaving the 'save' buffer uninitialized; subsequent scr_memcpyw() copies this uninitialized memory into screen regions during framebuffer console initialization and redraw operations.
Why it matters to the business
Linux systems using framebuffer-based consoles may experience kernel crashes, instability during boot or display reconfiguration, or exposure of residual kernel memory contents, increasing operational risk especially on Debian 11 and 12 deployments until kernels are updated.
How an attack unfolds
An attacker with local access or the ability to trigger framebuffer registration (for example via virtual GPU drivers) can force console binding and logo preparation paths that copy uninitialized kernel memory, potentially disclosing sensitive data or causing denial of service through KMSAN-detected uninit-value usage.
How to fix it
Upgrade affected Linux packages to the fixed versions: Debian 11 systems to linux 5.10.162-1 or later and Debian 12 systems to linux 6.1.4-1 or later; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Confirm the running kernel version matches or exceeds the listed fixed packages for the distribution; re-test console initialization paths under the same syzbot-style configurations to verify absence of uninit-value reports.
Typical attack path
- Trigger framebuffer device registration or hotplug events
- Cause console takeover and fbcon initialization
- Invoke fbcon_prepare_logo() during visual setup
- Trigger screen redraw or region update to copy uninitialized buffer contents
How to detect it
Review kernel logs for KMSAN uninit-value reports referencing do_update_region, fbcon_prepare_logo, or fbcon_init; examine crash dumps showing uninitialized buffers copied during register_framebuffer or drm_fbdev setup.
What your security team should do
- Prioritize patching Debian 11 and 12 systems to the specified fixed kernel versions within maintenance windows
- Monitor for kernel oops or KMSAN reports during framebuffer or console operations
- Restrict local access on systems where framebuffer consoles cannot be immediately updated
The record
In the Linux kernel, the following vulnerability has been resolved: fbcon: Use kzalloc() in fbcon_prepare_logo() A kernel built with syzbot's config file reported that scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2)) causes uninitialized "save" to be copied. ---------- [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0 [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1 Console: switching to colour frame buffer device 128x48 ===================================================== BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0 do_update_region+0x4b8/0xba0 update_region+0x40d/0x840 fbcon_switch+0x3364/0x35e0 redraw_screen+0xae3/0x18a0 do_bind_con_driver+0x1cb3/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) Uninit was stored to memory at: fbcon_prepare_logo+0x143b/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) Uninit was created at: __kmem_cache_alloc_node+0xb69/0x1020 __kmalloc+0x379/0x680 fbcon_prepare_logo+0x704/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 ----------
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | 5.10.162-1 |
| Debian:12 | linux | 0 | 6.1.4-1 |
| Debian:13 | linux | 0 | 6.1.4-1 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.4 | 0 | 5.4.0-1097.105~18.04.1 |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.4 | 0 | 5.4.0-1104.110~18.04.1 |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.4 | 0 | 5.4.0-1101.110~18.04.1 |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-5.4 | 0 | 5.4.0-144.161~18.04.1 |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-ibm-5.4 | 0 | 5.4.0-1045.50~18.04.1 |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.4 | 0 | 5.4.0-1094.103~18.04.1 |
| Ubuntu:18.04:LTS | linux-raspi-5.4 | 0 | 5.4.0-1081.92~18.04.1 |
| Ubuntu:20.04:LTS | linux | 0 | 5.4.0-144.161 |
| Ubuntu:20.04:LTS | linux-aws | 0 | 5.4.0-1097.105 |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1031.35~20.04.1 |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | 5.4.0-1104.110 |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1034.41~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | 5.15.0-1034.41~20.04.1.2 |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | 5.4.0-1059.65 |
| Ubuntu:20.04:LTS | linux-gcp | 0 | 5.4.0-1101.110 |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1030.37~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | 5.4.0-1065.69 |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | 5.15.0-1016.21~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-67.74~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | 5.4.0-1045.50 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1033.36~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1026.31~20.04.1 |
| Ubuntu:20.04:LTS | linux-iot | 0 | 5.4.0-1013.15 |
| Ubuntu:20.04:LTS | linux-kvm | 0 | 5.4.0-1087.93 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-67.74~20.04.1 |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | 5.4.0-1094.103 |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1030.36~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | 5.4.0-1081.92 |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | 5.15.0-1030.34~20.04.1 |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | 5.4.0-1022.26 |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-67.74 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1031.35 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1034.41 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde | 0 | 5.15.0-1034.41.1 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1030.37 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1028.33 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1016.21 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1026.29 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1026.31 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1029.34 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-67.74 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1023.23 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1030.36 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1025.27 |
| Ubuntu:22.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | 5.15.0-1022.26 |
| Ubuntu:22.04:LTS:for:NVIDIA:BlueField | linux-bluefield | 0 | No fix |
| Ubuntu:24.04:LTS | linux | 0 | No fix |
| Ubuntu:24.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:24.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:24.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:24.04:LTS | linux-intel | 0 | No fix |
| Ubuntu:24.04:LTS | linux-lowlatency | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia | 0 | No fix |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oem-6.11 | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oem-6.8 | 0 | No fix |
| Ubuntu:24.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:24.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:24.04:LTS | linux-raspi-realtime | 0 | No fix |
| Ubuntu:24.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:24.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:24.10 | linux | 0 | No fix |
| Ubuntu:24.10 | linux-aws | 0 | No fix |
| Ubuntu:24.10 | linux-azure | 0 | No fix |
| Ubuntu:24.10 | linux-gcp | 0 | No fix |
| Ubuntu:24.10 | linux-lowlatency | 0 | No fix |
| Ubuntu:24.10 | linux-oracle | 0 | No fix |
| Ubuntu:24.10 | linux-raspi | 0 | No fix |
| Ubuntu:24.10 | linux-realtime | 0 | No fix |
| Ubuntu:24.10 | linux-riscv | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux-lts-xenial | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-aws-hwe | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-azure-4.15 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gcp-4.15 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-azure-5.8 | 0 | No fix |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux