CVE-2022-48804

A vulnerability was found in the Linux kernel's vt_ioctl subsystem, where the vt_setactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using array_index_nospec. This can potentially allow unauthorized access or manipulation of memory.

An integer underflow vulnerability was found in the Linux kernel's virtual terminal handling, in the vt_setactivate function of the vt_ioctl code. This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 and is rated Moderate impact by Red Hat. The vsa.console value was decremented after being sanitized with array_index_nospec(); because array_index_nospec() clamps an out-of-bounds value to zero on the transient path, subtracting one afterwards causes a transient integer underflow. A local authenticated user able to reach this virtual-terminal activation path could trigger a transient (speculative-execution) out-of-bounds access, potentially allowing unauthorized memory reads via side channels; the issue was reported by the VUSec group at VU Amsterdam as part of the KASPER transient-execution research. The need for local authenticated access and the transient nature of the out-of-bounds access limit the practical impact. Fixes have been pursued for the affected supported Red Hat Enterprise Linux 8 and 9 streams, while several older maintenance update streams were closed as wontfix. Red Hat Enterprise Linux 6 Extended Lifecycle Support and Fedora are not affected. The NIST CVSS 3.1 base score for this flaw is 5.5 with availability impact only, while the Red Hat score of 7.1 also rates confidentiality impact as high; the overall Red Hat severity is Moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.