Fix crash in smtcfb_write() in video: fbdev: sm712fb
Summary
GSD-2022-1002040: video: fbdev: sm712fb: Fix crash in smtcfb_write(). Affects Kernel versions < b1c28577529cdfad40c8242673285f1e1e4c314e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The video: fbdev: sm712fb package is a component of the Linux Kernel. It provides support for the Silicon Motion SM712 graphics controller. The SM712 graphics controller is commonly used in embedded systems and provides basic framebuffer functionality. The smtcfb_write() function within the package is responsible for writing data to the framebuffer. However, a vulnerability has been discovered in this function that can lead to a crash.
Vulnerability Detail
The vulnerability in the smtcfb_write() function can be triggered by passing a large value as the length parameter. This can cause an out-of-bounds write, leading to a crash. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition on a system utilizing the SM712 graphics controller. The vulnerability has been fixed in Linux Kernel version v5.10.110 by commit b1c28577529cdfad40c8242673285f1e1e4c314e.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the vulnerability by ensuring that the length parameter passed to the smtcfb_write() function is within valid bounds. This can be achieved by validating the length parameter before calling the function. Here is an example of how this can be done in C:
if (length <= MAX_VALID_LENGTH) {
smtcfb_write(data, length);
}
Conclusion
The video: fbdev: sm712fb package in the Linux Kernel is vulnerable to a crash caused by an out-of-bounds write in the smtcfb_write() function. This vulnerability can be mitigated by updating the Linux Kernel to version v5.10.110 or later. Users can also implement a workaround by validating the length parameter before calling the smtcfb_write() function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a crash in systems utilizing the SM712 graphics controller, potentially causing a denial-of-service (DoS) condition.
No, this vulnerability requires local access to the system.
There is no evidence of this vulnerability being actively exploited at this time.
The recommended mitigation is to update the Linux Kernel to version v5.10.110 or later.
More information about this vulnerability can be found in the Linux Kernel repository and the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
