CVE-2023-3161

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

Weakness

An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

Affected Software

Extended Description

Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.

Potential Mitigations

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2213485
• https://github.com/torvalds/linux/commit/2b09d5d364986f724f17001ccfe4126b9b43a0be
• https://bugzilla.redhat.com/show_bug.cgi?id=2213485
• https://github.com/torvalds/linux/commit/2b09d5d364986f724f17001ccfe4126b9b43a0be