CVE-2023-38409: Race Condition
An issue was discovered in setcon2fbmap in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbconregisteredfb and fbcondisplay arrays can be desynchronized in fbconmodedeleted (the con2fbmap points at the old fbinfo).
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a flaw in the setcon2fbmap function in drivers/video/fbdev/core/fbcon.c. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38409?
CVE-2023-38409 has been rated as a medium severity vulnerability in versions of the Linux kernel before 6.2.12.
How do I fix CVE-2023-38409?
To fix CVE-2023-38409, upgrade the Linux kernel to version 6.3 or later.
What component is affected by CVE-2023-38409?
CVE-2023-38409 affects the framebuffer console handling in the Linux kernel's fbdev subsystem.
Does CVE-2023-38409 affect all Linux distributions?
CVE-2023-38409 may affect any Linux distribution using a vulnerable kernel version prior to 6.2.12.
When was CVE-2023-38409 discovered?
CVE-2023-38409 was discovered in the Linux kernel versions before 6.2.12, specifically concerning the function set_con2fb_map.