Linux Kernel Framebuffer Subsystem Use-After-Free Vulnerability in Mode Handling

A use-after-free vulnerability has been identified in the Linux kernel's framebuffer (fbdev) subsystem, specifically within the 'store_modes()' function. This vulnerability arises when 'store_modes()' replaces a framebuffer's modelist with modes from userspace. Upon successful replacement, the old modelist is freed, but two fields remain pointing to the freed memory. One field, 'fb_display[i].mode', represents the mode a console is using. The 'fbcon_new_modelist()' function can update these pointers, but it only affects consoles still mapped to the framebuffer. Unmapped consoles retain their stale pointers, leading to a use-after-free condition when the old pointer is accessed. The second field, 'fb_info->mode', indicates the current mode and is set through the mode sysfs attribute. However, 'store_modes()' does not update this field, leaving it to point to the freed list. The issue can be exploited by sending an 'FBIOPUT_VSCREENINFO' ioctl with 'FB_ACTIVATE_INV_MODE', which triggers the use-after-free by accessing the stale pointer through the mode string handler.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, which can potentially be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.

Reproduction

The vulnerability can be reproduced by unbinding a console from the framebuffer, which leaves a stale pointer in 'fb_display[i].mode'. Then, send an 'FBIOPUT_VSCREENINFO' ioctl with 'FB_ACTIVATE_INV_MODE' to trigger the use-after-free condition.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.