CVE-2021-47383

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue occurs when a userspace program performs an ioctl FBIOPUT VSCREENINFO, passing a fb var screeninfo struct with only xres, yres, and bits per pixel fields, and their values. If this struct is the same as the previous ioctl, vc resize() detects it and doesn't call resize screen(), leaving fb var screeninfo incomplete. This leads to updatescrollmode() calculating a wrong value for fbcon display->vrows, causing real y() to return an incorrect value of y. This incorrect value eventually causes imageblit to access an out-of-bound address.

Recommendations To solve this issue, the resize screen() function is called even if the screen does not need resizing, ensuring fb var screeninfo is "fixed and filled" independently. At the moment, there is no information about a newer version that contains a fix for this vulnerability.