Bugzilla – Bug 1157813
VUL-1: CVE-2019-19252: kernel-source: vcs_write in drivers/tty/vt/vc_screen.c does not prevent write access to vcsu devices
Last modified: 2022-12-23 11:44:35 UTC
CVE-2019-19252 vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19252 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19252.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19252 https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb@suse.com/
In -next as: commit 0c9acb1af77a3cb8707e43f45b72c95266903cee Author: Nicolas Pitre <nico@fluxnic.net> Date: Tue Nov 5 10:33:16 2019 +0100 vcs: prevent write access to vcsu devices
The fix is in 5.5-rc1. The bug was introduced by: commit d21b0be246bf3bbf569e6e239f56abb529c7154e Author: Nicolas Pitre <nico@fluxnic.net> Date: Tue Jun 26 23:56:41 2018 -0400 vt: introduce unicode mode for /dev/vcs in 4.19. So affected is only SLE15-SP2 and stable. master is on 5.5 already. And both SLE15-SP2 and stable received the fix via stable, so I only updated the tags.
fixed