linux-kernel - Re: Bug with /dev/vcs* devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b3b85cb-1a94-5330-9236-ed192c1f4fa0@infradead.org>
Date:   Sun, 19 Feb 2023 14:11:00 -0800
From:   Randy Dunlap <rdunlap@...radead.org>
To:     Storm Dragon <stormdragon2976@...il.com>,
        linux-kernel@...r.kernel.org,
        George Kennedy <george.kennedy@...cle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: Bug with /dev/vcs* devices

[add George and Greg]

@Storm: You should always send emails directly to someone as well as to the mailing list.


On 2/19/23 13:21, Storm Dragon wrote:
> Howdy,
> 
> This is my first time ever submitting a kernel bug, so I apologize if this is the wrong place. As per the instructions I found, I first filed a bug in Arch Linux:
> 
> https://bugs.archlinux.org/task/77575
> 
> I will add the contents of the response here:
> 
> For the record, here are the 2 associated mailing list threads [1][2].
>                                                                                                                                                                 The reason why it affects both LTS and current linux is because it appears a security patch was applied to both trees to fix a UAF (use after free) bug.
>                                                                                                                                                                 If that patch is problematic, you should report it upstream to the kernel folks. Maybe even email the patch author directly. It's this patch [3]. Please let us
> know what you find out.
>                                                                                                                                                                 [1] https://lists.archlinux.org/archives/list/arch-general%40lists.archlinux.org/thread/EOSHIVGUZLNAD7BPHSUGOXFYSAFWDYH7/
> [2] https://lists.archlinux.org/archives/list/arch-general%40lists.archlinux.org/thread/S6R6UDUMX2LWL4HJ74MFNYOES45UBFLF/
> [3] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/tty/vt/vc_screen.c?h=v5.15.94&id=fc9e27f3ba083534b8bbf72ab0f5c810ffdc7d18
> 
> ----------End Response ----------
> 
> Methods for reproducing the bug are included in the link to the bug above. But I will include one of them here as well. As root:
> 
> [root@...llnir ~]# cat /dev/vcsa1
>                                                                                                                                                                    cat: /dev/vcsa1: No such device or address
> 
> The contents is displayed very briefly before the No such device or address error.
> 
> Thank you,
> Storm

-- 
~Randy