{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Use kzalloc() in fbcon_prepare_logo()\n\nA kernel built with syzbot's config file reported that\n\n  scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))\n\ncauses uninitialized \"save\" to be copied.\n\n  ----------\n  [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0\n  [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1\n  Console: switching to colour frame buffer device 128x48\n  =====================================================\n  BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0\n   do_update_region+0x4b8/0xba0\n   update_region+0x40d/0x840\n   fbcon_switch+0x3364/0x35e0\n   redraw_screen+0xae3/0x18a0\n   do_bind_con_driver+0x1cb3/0x1df0\n   do_take_over_console+0x11cb/0x13f0\n   fbcon_fb_registered+0xacc/0xfd0\n   register_framebuffer+0x1179/0x1320\n   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n   drm_fbdev_client_hotplug+0xbea/0xda0\n   drm_fbdev_generic_setup+0x65e/0x9d0\n   vkms_init+0x9f3/0xc76\n   (...snipped...)\n\n  Uninit was stored to memory at:\n   fbcon_prepare_logo+0x143b/0x1940\n   fbcon_init+0x2c1b/0x31c0\n   visual_init+0x3e7/0x820\n   do_bind_con_driver+0x14a4/0x1df0\n   do_take_over_console+0x11cb/0x13f0\n   fbcon_fb_registered+0xacc/0xfd0\n   register_framebuffer+0x1179/0x1320\n   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n   drm_fbdev_client_hotplug+0xbea/0xda0\n   drm_fbdev_generic_setup+0x65e/0x9d0\n   vkms_init+0x9f3/0xc76\n   (...snipped...)\n\n  Uninit was created at:\n   __kmem_cache_alloc_node+0xb69/0x1020\n   __kmalloc+0x379/0x680\n   fbcon_prepare_logo+0x704/0x1940\n   fbcon_init+0x2c1b/0x31c0\n   visual_init+0x3e7/0x820\n   do_bind_con_driver+0x14a4/0x1df0\n   do_take_over_console+0x11cb/0x13f0\n   fbcon_fb_registered+0xacc/0xfd0\n   register_framebuffer+0x1179/0x1320\n   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n   drm_fbdev_client_hotplug+0xbea/0xda0\n   drm_fbdev_generic_setup+0x65e/0x9d0\n   vkms_init+0x9f3/0xc76\n   (...snipped...)\n\n  CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924\n  Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n  ----------"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/video/fbdev/core/fbcon.c"
               ],
               "versions": [
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "20e78b7d1c10",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "9d5126b574c9",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "d9b53caf0191",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "e70a5724400a",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "9bbebc6aba72",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "a6a00d7e8ffd",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/video/fbdev/core/fbcon.c"
               ],
               "versions": [
                  {
                     "version": "4.19.269",
                     "lessThanOrEqual": "4.19.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.4.227",
                     "lessThanOrEqual": "5.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.10.159",
                     "lessThanOrEqual": "5.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.83",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.0.13",
                     "lessThanOrEqual": "6.0.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/20e78b7d1c1019789d9754ad9246192916f1a3b4"
            },
            {
               "url": "https://git.kernel.org/stable/c/9d5126b574c9177ed9ca925e36f85a1e6ce80bd2"
            },
            {
               "url": "https://git.kernel.org/stable/c/d9b53caf0191cee24afd05ca6c83ed873199b52d"
            },
            {
               "url": "https://git.kernel.org/stable/c/e70a5724400a841c9857ee3d08dae4d6c53ee40d"
            },
            {
               "url": "https://git.kernel.org/stable/c/9bbebc6aba72ece39a200c8141f44e68ba883877"
            },
            {
               "url": "https://git.kernel.org/stable/c/a6a00d7e8ffd78d1cdb7a43f1278f081038c638f"
            }
         ],
         "title": "fbcon: Use kzalloc() in fbcon_prepare_logo()",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2022-48993",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}