In the Linux kernel, the following vulnerability has been resolved:
tty: vt: initialize unicode screen buffer
syzbot reports kernel infoleak at vcs_read() [1], for buffer can be read immediately after resize operation. Initialize buffer using kzalloc().
#include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fb.h>
int main(int argc, char *argv[]) { struct fbvarscreeninfo var = { }; const int fbfd = open("/dev/fb0", 3); ioctl(fbfd, FBIOGETVSCREENINFO, &var); var.yres = 0x21; ioctl(fbfd, FBIOPUTVSCREENINFO, &var); return read(open("/dev/vcsu", ORDONLY), &var, sizeof(var)) == -1; }
{ "vanir_signatures": [ { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-20b40390", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e02fa87e572bb7d90dcdbce9c0f519f1eb992e96" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-4e03c478", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@446f123aa6021e5f75a20789f05ff3f7ae51a42f" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-61420278", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af77c56aa35325daa2bc2bed5c2ebf169be61b86" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-9902d335", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@777a462e1ae50a01fc4a871efa8e34d596a1e17d" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-9babded2", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c6c65681f39bf71bc72ed589dec3b8b20e75cac" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-e9ef0a35", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0ef23e9b0ad18b9fd3741b0f1ad2282e4a18def" }, { "target": { "file": "drivers/tty/vt/vt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "168716721919152611864129113017327241604", "335656522799867435498046282342211150846", "202436319585224093500412776343023503787", "173780856126456325283665573986443945318" ] }, "deprecated": false, "id": "CVE-2022-50222-f722dcf1", "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc9e874dace0c89ae535230c7da19b764746811e" } ] }