CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of virtual console writes, specifically in the vcs_notifier function, which can lead to a null pointer dereference due to a race condition. This flaw may allow an attacker to cause a denial-of-service condition by exploiting the timing of concurrent writes, potentially impacting system stability. System administrators and developers managing Linux environments should prioritize applying the fix to mitigate the risk of crashes related to this issue.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().
Related CVEs
Other vulnerabilities affecting the same vendor(s)