Bug 1976208

Summary: kernel: out-of-bounds read in vgacon subsystem in vgacon_scrolldelta()
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED DUPLICATE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, blc, brdeoliv, bskeggs, chwhite, crwood, dhoward, dvlasenk, fcanogab, fhrbata, fpacheco, hdegoede, hkrzesin, jarod, jarodwilson, jeremy, jforbes, jglisse, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, steved, walters, wcosta, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.8.10 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of the software scrollback video code on VGA consoles when a local attacker attempts to scroll the console. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2021-07-06 17:47:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1979451, 1883596, 1883597, 1883598, 1883599, 1883600, 1976209, 1979450, 1979452, 1979453, 1979533, 1979534, 1979535, 1979536, 1979537, 1979538    
Bug Blocks: 1976210    

Description Guilherme de Almeida Suckevicz 2021-06-25 14:16:11 UTC 
The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read.

Reference:
https://seclists.org/oss-sec/2020/q3/176

Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=973c096f6a85e5b5f2a295126ba6928d9a6afd45
Comment 1 Guilherme de Almeida Suckevicz 2021-06-25 14:18:24 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1976209]
Comment 2 Justin M. Forbes 2021-06-29 16:07:46 UTC 
This was fixed for Fedora with the 5.8.10 stable kernel updates.
Comment 8 Alex 2021-07-06 17:47:22 UTC 

*** This bug has been marked as a duplicate of bug 1880006 ***