CVE-2024-50076

What it actually does

Uninitialized memory in font.data returned by con_font_get may leak kernel contents to userspace due to incomplete initialization by vc->vc_sw->con_font_get.

Why it matters to the business

Local attackers on affected systems can read sensitive kernel memory, increasing risk of credential or key exposure on legacy QEMU deployments with low ecosystem prevalence.

How an attack unfolds

An attacker with local access invokes con_font_get via virtual console font retrieval, receives partially uninitialized kernel memory in the returned structure, and parses it for useful data; listed threat actors have targeted similar Linux kernel uninitialized-resource issues in espionage and financial campaigns.

How to fix it

Upgrade qemu on Ubuntu 14.04 LTS to 2.0.0+dfsg-2ubuntu1.19 or later; apply equivalent kernel fixes if backported to the running distribution.

How to confirm the fix worked

Verify package version meets or exceeds the listed fixed release, recompile with memory-initialization checks if source is available, and confirm no uninitialized bytes are returned in con_font_get output.

Typical attack path

1. Obtain local shell or userland execution on affected host
2. Trigger con_font_get through console or vt ioctl/font API
3. Receive kernel buffer containing uninitialized bytes
4. Extract sensitive information from leaked memory

How to detect it

Review kernel audit logs and application logs for repeated font or vt ioctl calls from untrusted users; examine memory dumps or strace output for con_font_get activity returning unexpected data lengths.

What your security team should do

• Immediately upgrade all qemu packages on Ubuntu 14.04 LTS instances
• Audit systems still running the vulnerable release and isolate or decommission where possible
• Enable kernel memory poisoning or similar mitigations if supported
• Monitor EPSS trend for any future increase in exploitation likelihood