CVE-2023-3161
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel, occurring when font->width and font->height values greater than 32 are provided. The lack of checks leads to a shift-out-of-bounds, resulting in undefined behavior and possible denial of service.
Risk Assessment
The organization may be exposed to attacks leading to denial of service, affecting the availability of systems using the fbcon console.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and implement proper checks in font configurations.
Original NVD description (English source)
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.