CVE-2024-50048

What it actually does

NULL pointer dereference in fbcon_putcs when ops->putcs remains uninitialized after set_con2fb_map and subsequent TIOCLINUX/FBIOPUT_CON2FBMAP ioctls trigger redraw_screen -> hide_cursor -> clear_selection -> highlight -> invert_screen -> do_update_region.

Why it matters to the business

Local users can trigger kernel panics on affected Linux systems, causing denial of service and loss of availability for console or graphical sessions; low exploitation probability but high impact on stability for systems relying on framebuffer console.

How an attack unfolds

An attacker opens /dev/fb and /dev/tty devices, issues FBIOPUT_CON2FBMAP to remap consoles, sends a TIOCLINUX selection ioctl, then re-issues FBIOPUT_CON2FBMAP to force a display redraw path that reaches fbcon_putcs with a NULL ops->putcs pointer, crashing the kernel.

How to fix it

Update the Linux kernel to commit 8266ae6eafdcd5a3136592445ff4038bbc7ee80e or later; Rocky Linux dotnet6.0 users should apply package 0:6.0.103-4.el8_5 or newer; ensure set_blitting_type is called inside set_con2fb_map.

How to confirm the fix worked

Verify kernel source contains the set_blitting_type call inside set_con2fb_map; boot patched kernel and confirm the reproducer no longer triggers a panic; check /proc/version or package manager for the fixed commit or version string.

Typical attack path

1. Open /dev/fb1 and /dev/tty1
2. Issue FBIOPUT_CON2FBMAP to set console-to-fb mapping with framebuffer 0
3. Issue TIOCLINUX ioctl with selection parameters
4. Re-issue FBIOPUT_CON2FBMAP to trigger con2fb_init_display path
5. Reach fbcon_putcs with uninitialized ops->putcs causing NULL dereference and panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference or panic traces that include fbcon_putcs, set_con2fb_map, or clear_selection; correlate with unusual ioctl activity on /dev/fb or /dev/tty devices from unprivileged processes.

What your security team should do

• Apply the kernel update containing commit 8266ae6eafdcd5a3136592445ff4038bbc7ee80e as soon as possible on all affected systems
• Restrict unprivileged access to framebuffer and tty ioctls via LSM or seccomp where console remapping is unnecessary
• Monitor for kernel oops/panic logs containing fbcon_putcs or clear_selection symbols