Use-after-free vulnerability in video: fbdev: vesafb
Summary
GSD-2022-1002683: video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup. Affects Kernel versions >= b3c9a924aab61adbc29df110006aa03afe1a78ba, < d260cad015945d1f4bb9b028a096f648506106a2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The video: fbdev: vesafb package is a component of the Linux Kernel. It provides support for the vesafb framebuffer driver, which allows for graphical output on certain video hardware. The package is responsible for managing the framebuffer device and providing an interface for applications to interact with it.
Vulnerability Detail
The use-after-free vulnerability in video: fbdev: vesafb is caused by an early cleanup of the fb_info structure, which can lead to a use-after-free condition. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v5.18 of the Linux Kernel and has been fixed in version v5.18.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
Conclusion
The use-after-free vulnerability in video: fbdev: vesafb can be mitigated by updating the Linux Kernel to version v5.18.3 or later. It is recommended to apply the fix as soon as possible to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
video: fbdev: vesafb is a package in the Linux Kernel that provides support for the vesafb framebuffer driver, allowing for graphical output on certain video hardware.
A use-after-free vulnerability occurs when a program continues to use a memory address after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
This vulnerability can be exploited by an attacker who has the ability to trigger the use-after-free condition. By carefully crafting input or executing specific actions, the attacker can manipulate the freed memory to execute arbitrary code or cause a crash.
Yes, this vulnerability has been fixed in version v5.18.3 of the Linux Kernel.
For more information about this vulnerability, you can refer to the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
