Linux Kernel Race Condition Vulnerability in Virtual Console Screen Driver Allows Null Pointer Dereference

A race condition vulnerability has been identified in the Linux kernel's virtual console screen driver, specifically within the 'vcs_write' function. This issue arises when the 'console_lock' is temporarily released to transfer data from userspace, potentially causing the 'vc_data' pointer to become outdated. If the associated virtual console has been deallocated before the pointer is re-validated, a null pointer dereference occurs in the 'vcs_notifier' function, leading to a crash. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability causes a null pointer dereference, leading to a crash of the affected system or application.

Reproduction

The vulnerability can be reproduced by writing data to a virtual console while the 'console_lock' is temporarily released. This can be done by creating a scenario where the 'vcs_write' function is called with data from userspace, allowing the 'vc_data' pointer to become stale. After the lock is released, the pointer is re-validated, but if the virtual console has been deallocated in the meantime, a null pointer is returned. The 'vcs_scr_updated' function is then called with this null pointer, causing a null pointer dereference in the notifier chain.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.