Linux Kernel Auxdisplay Line-Display Out-of-Bounds Read Vulnerability

A vulnerability in the Linux kernel's auxdisplay line-display driver can lead to an out-of-bounds read. This issue arises because the 'linedisp_display' function reads the message buffer without checking if the length is zero. Writing a zero-length message to the sysfs attribute triggers this flaw, as the kernel's write buffer allocation allows for an invalid read. On kernels with KASAN enabled, this out-of-bounds access is reported and causes a panic. However, on standard kernels, it quietly reads adjacent memory, potentially leading to further issues. This vulnerability affects all auxdisplay drivers registered through 'linedisp_register' or 'linedisp_attach', including ht16k33, max6959, img-ascii-lcd, and seg-led-gpio.

Impact

Exploitation of this vulnerability causes a kernel panic on KASAN-enabled systems due to an out-of-bounds memory access. On regular kernels, it silently reads adjacent slab data, which could lead to unintended behavior or data exposure. If the read data includes a newline character, it can manipulate the message handling process, causing further memory management issues.

Reproduction

The vulnerability can be reproduced by writing a zero-length message to the 'message' sysfs attribute of an auxdisplay line-display driver. This can be done using a file descriptor opened for writing, such as through the command 'write(fd, "", 0)'. The 'message_store' function will be called with a count of zero, triggering the out-of-bounds read when 'linedisp_display' accesses 'msg[count - 1]'.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been patched. The official Linux kernel repositories provide the necessary updates.