CVE-2021-33655: Medium severity android vulnerability
A flaw in the Linux Kernel framebuffer-based console driver found. When sending malicious data to kernel by ioctl FBIOPUTVSCREENINFO, kernel will write memory out of bounds. To trigger the vulnerability user need to have access to console driver like /dev/fb0.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=086ff84617185393a0bbf25830c4f36412a7d3f4
Other sources
An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUTVSCREENINFO with malicious data. This flaw allows a local user to crash or potentially escalate their privileges on the system.
When sending malicous data to kernel by ioctl cmd FBIOPUTVSCREENINFO,kernel will write memory out of bounds.
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-33655?
CVE-2021-33655 has been classified with a high severity due to potential memory corruption which could lead to system crashes or privilege escalation.
How do I fix CVE-2021-33655?
To mitigate CVE-2021-33655, upgrade to the recommended kernel versions, such as 0:4.18.0-477.10.1.rt7.274.el8_8 or 5.14.0-284.11.1.el9_2.
Who is affected by CVE-2021-33655?
CVE-2021-33655 affects users running specific versions of the Linux kernel and its derivatives, particularly those with access to the framebuffer device.
What is CVE-2021-33655?
CVE-2021-33655 is a vulnerability in the Linux Kernel framebuffer-based console driver that allows for memory writes out of bounds through malicious ioctl calls.
Can CVE-2021-33655 be exploited remotely?
No, CVE-2021-33655 requires local access to the console driver, such as /dev/fb0, making remote exploitation unlikely.