Junglewise Threat Intelligence

CVE-2024-35823: Linux Kernel buffer corruption in virtual terminal Unicode handling

CVE-2024-35823 · Severity: medium · CVSS 5.3 · Published 2024-05-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's virtual terminal component can lead to memory corruption when deleting characters on the screen. This issue affects the way text is handled in the system console, potentially causing system instability or minor service disruptions. While the impact is primarily limited to availability, it represents a flaw in core system software used across many Linux distributions.

Technical details

A vulnerability exists in the Linux kernel's virtual terminal (vt) driver, specifically within the `vc_uniscr_delete` function in `drivers/tty/vt/vt.c`. The issue stems from the use of `memcpy()` to handle overlapping memory regions when shifting characters in the Unicode screen buffer during a delete operation. According to the C standard, `memcpy()` behavior is undefined when source and destination buffers overlap; this can lead to memory corruption. The fix replaces `memcpy()` with `memmove()`, which is designed to safely handle overlapping memory regions. An attacker could potentially trigger this corruption to cause a denial-of-service (system crash or terminal instability). The vulnerability has been patched in multiple stable kernel branches including 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, and 6.7.12.

Affected products

  • Linux Linux Kernel 3.7 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8.x

Timeline

  • 2024-02-29: patched: Initial fix authored by Nicolas Pitre
  • 2024-05-17: disclosed: CVE-2024-35823 published

References

Related threats