CVE-2023-53747

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF

After a call to console_unlock() in vcs_write() the vc_data struct can be

freed by vc_port_destruct(). Because of that, the struct vc_data pointer

must be reloaded in the while loop in vcs_write() after console_lock() to

avoid a UAF when vcs_size() is called.

Syzkaller reported a UAF in vcs_size().

BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215)

Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119

Call Trace:

<TASK>

__asan_report_load4_noabort (mm/kasan/report_generic.c:380)

vcs_size (drivers/tty/vt/vc_screen.c:215)

vcs_write (drivers/tty/vt/vc_screen.c:664)

vfs_write (fs/read_write.c:582 fs/read_write.c:564)

...

<TASK>

Allocated by task 1213:

kmalloc_trace (mm/slab_common.c:1064)

vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680

drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References