CVE-2023-3161

What it actually does

Out-of-bounds shift in fbcon_set_font when font->width or font->height exceeds 32 with no bounds validation, causing undefined behavior and possible denial of service.

Why it matters to the business

Local denial of service on Linux systems using framebuffer console, potentially disrupting system availability for users with console access.

How an attack unfolds

An attacker with local access supplies crafted font dimensions greater than 32 to fbcon_set_font, triggering the unchecked shift that leads to kernel instability or crash.

How to fix it

Update the Linux kernel to the fixed commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or a later equivalent release that enforces proper bounds checking on font dimensions.

How to confirm the fix worked

Confirm the running kernel contains commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c; attempt to set fonts with dimensions >32 in a test environment to verify the crash is prevented.

Typical attack path

1. Obtain local shell access on an affected Linux system
2. Prepare a font structure with width or height values exceeding 32
3. Invoke fbcon_set_font via the appropriate kernel interface
4. Trigger the out-of-bounds shift resulting in undefined behavior or DoS

How to detect it

Review kernel logs for shift-out-of-bounds warnings or fbcon_set_font errors; correlate with processes attempting console font changes.

What your security team should do

• Apply the referenced kernel commit across all affected systems
• Limit local console access to trusted users until patched
• Monitor kernel logs for fbcon-related faults