From aa6b8f17874d5d12c9b5ac389e16b47ff751e851 Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Fri, 6 Dec 2019 17:57:33 +0800 Subject: [PATCH] vcs: prevent write access to vcsu devices mainline inclusion from mainline-v5.5 commit 0c9acb1af77a3cb8707e43f45b72c95266903cee category: bugfix bugzilla: 13690 CVE: CVE-2019-19252 ------------------------------------------------- Commit d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") guarded against using devices containing attributes as this is not yet implemented. It however failed to guard against writes to any devices as this is also unimplemented. Reported-by: Or Cohen Signed-off-by: Nicolas Pitre Cc: # v4.19+ Cc: Jiri Slaby Fixes: d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.1911051030580.30289@knanqh.ubzr Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yang Yingliang Reviewed-by: Yue Haibing Signed-off-by: Yang Yingliang --- drivers/tty/vt/vc_screen.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 2384ea85ffaf..2fb509d57e88 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -437,6 +437,9 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) size_t ret; char *con_buf; + if (use_unicode(inode)) + return -EOPNOTSUPP; + con_buf = (char *) __get_free_page(GFP_KERNEL); if (!con_buf) return -ENOMEM; -- GitLab