linux-kernel - Bug with /dev/vcs* devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y/KS6vdql2pIsCiI@hotmail.com>
Date:   Sun, 19 Feb 2023 16:21:46 -0500
From:   Storm Dragon <stormdragon2976@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: Bug with /dev/vcs* devices

Howdy,

This is my first time ever submitting a kernel bug, so I apologize if this is the wrong place. As per the instructions I found, I first filed a bug in Arch Linux:

https://bugs.archlinux.org/task/77575

I will add the contents of the response here:

For the record, here are the 2 associated mailing list threads [1][2].

The reason why it affects both LTS and current linux is because it appears a security patch was applied to both trees to fix a UAF (use after free) bug.

If that patch is problematic, you should report it upstream to the kernel folks. Maybe even email the patch author directly. It's this patch [3]. Please let us
know what you find out.

[1] https://lists.archlinux.org/archives/list/arch-general%40lists.archlinux.org/thread/EOSHIVGUZLNAD7BPHSUGOXFYSAFWDYH7/
[2] https://lists.archlinux.org/archives/list/arch-general%40lists.archlinux.org/thread/S6R6UDUMX2LWL4HJ74MFNYOES45UBFLF/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/tty/vt/vc_screen.c?h=v5.15.94&id=fc9e27f3ba083534b8bbf72ab0f5c810ffdc7d18

----------End Response ----------

Methods for reproducing the bug are included in the link to the bug above. But I will include one of them here as well. As root:

[root@...llnir ~]# cat /dev/vcsa1

    cat: /dev/vcsa1: No such device or address

The contents is displayed very briefly before the No such device or address error.

Thank you,
Storm

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)