CVE-2022-50221

In the Linux kernel, the following vulnerability has been resolved:

drm/fb-helper: Fix out-of-bounds access

Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling.

Fbdev's deferred I/O can only track pages. From the range of pages, the damage handler computes the clipping rectangle for the display update. If the fbdev screen buffer ends near the beginning of a page, that page could contain more scanlines. The damage handler would then track these non-existing scanlines as dirty and provoke an out-of-bounds access during the screen update. Hence, clip the maximum memory range to the size of the screen buffer.

While at it, rename the variables min/max to min_off/max_off in drm_fb_helper_deferred_io(). This avoids confusion with the macros of the same name.

This vulnerability is rated as Moderate severity because exploitation requires local access with permissions to interact with the framebuffer device, precluding remote vectors. The flaw resides in the DRM fbdev emulation layer when handling deferred I/O updates for display geometries that do not align with memory page boundaries, leading to an out-of-bounds write. In typical Red Hat Enterprise Linux environments, direct access to framebuffer devices is restricted to privileged accounts or local console sessions, significantly limiting exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.