CVE-2023-38409
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An issue was discovered in set_con2fb_map in the Linux kernel before version 6.2.12. The problem is that an assignment occurs only for the first vc, which can lead to desynchronization of the fbcon_registered_fb and fbcon_display arrays.
Risk Assessment
Desynchronization of the arrays may lead to incorrect display of information on the screen, affecting system stability and usability. This vulnerability could potentially allow attackers to exploit it to introduce unauthorized changes to displayed data.
Recommendation
It is recommended to update the Linux kernel to version 6.2.12 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).