Vulnerability in Kernel package: tty: Fix out-of-bound vmalloc access in imageblit
Summary
GSD-2021-1001503: tty: Fix out-of-bound vmalloc access in imageblit. Affects Kernel versions < 7e71fcedfda6f7de18f850a6b36e78d78b04476f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices, including input/output (I/O) devices. The tty subsystem within the Kernel is responsible for handling terminal devices, such as serial ports and virtual consoles. The imageblit function in the tty subsystem is used for copying image data to the screen. However, a vulnerability has been discovered in the imageblit function that allows for out-of-bound vmalloc access. This vulnerability could potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability in the imageblit function of the tty subsystem arises from an out-of-bound vmalloc access. This means that the function may attempt to access memory beyond the allocated boundaries, leading to a potential buffer overflow or other memory-related issues. An attacker could exploit this vulnerability by crafting a malicious image data that triggers the out-of-bound access and gain control over the affected system. The impact of this vulnerability could range from unauthorized access to the system to remote code execution, depending on the attacker's intentions and the system's configuration. The vulnerability has been addressed in the Linux Kernel version v4.4.286 by commit 7e71fcedfda6f7de18f850a6b36e78d78b04476f.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v4.4.286 or later. This can be done by downloading the updated Kernel source code from the official Git repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it for the target system. Alternatively, users can wait for their Linux distribution to release an updated package that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by modifying the Kernel configuration to exclude the tty subsystem or the imageblit function. However, this may result in the loss of certain terminal device capabilities or functionalities. It is recommended to apply the official fix as soon as possible.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's tty subsystem, specifically in the imageblit function. This vulnerability allows for out-of-bound vmalloc access, which could be exploited by an attacker to gain unauthorized access or execute arbitrary code on the affected system. It is crucial to update the Linux Kernel package to version v4.4.286 or later to mitigate this vulnerability. Users can also use Vulert's playground (https://vulert.com/scanner) to check if their system is affected and receive real-time monitoring and alerts for open-source vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from unauthorized access to the affected system to remote code execution, depending on the attacker's intentions and the system's configuration.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, a workaround is available. Users can disable the affected functionality by modifying the Kernel configuration to exclude the tty subsystem or the imageblit function. However, it is recommended to apply the official fix as soon as possible.
The official fix for this vulnerability is available in the Linux Kernel version v4.4.286 or later. You can download the updated Kernel source code from the official Git repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compile it for your system. Alternatively, you can wait for your Linux distribution to release an updated package that includes the fix.
This vulnerability was discovered by an automated ID intended to aid in the discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.