CVE-2021-33655
Moderate
CVE-2021-33655
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
Exploit probability
0.3%
Published
July 18, 2022
Required by
Not available
Last source change
March 15, 2026
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
ASB-A-240019719
View original source
In fbcon_set_font() of fbcon.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Open Source Vulnerabilities
CVE-2021-33655
View original source
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
05 / REFERENCES
Further evidence
- https://android.googlesource.com/kernel/common/+/52833e8fafb2ada5329f89b4e03a838ace0644bd
- https://android.googlesource.com/kernel/common/+/b54f2a0d7bc35bec294c796e5b779a2c960b1145
- https://android.googlesource.com/kernel/common/+/e8a2596dec19b4ed1d9a3b3a0dcc428b0468074a
- https://source.android.com/security/bulletin/2023-03-01
- http://www.openwall.com/lists/oss-security/2022/07/19/2
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=086ff84617185393a0bbf25830c4f36412a7d3f4
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
- https://www.debian.org/security/2022/dsa-5191