printer-cracktro

printer cracktro Pwn2Own Toronto 2022 に向けた私の Pwn2Own エントリーは、2 種類のプリンターを対象としていました。 1 つは Linux ベース Lexmark、もう 1 つは DryOS ベース CANON です。 プリンター上のソフトウェアを pwn した後、エントリーは勝利を祝う/示すために、ちょっとした 昔ながらのクラックイントロ風アニメーションを表示するようになっていました。 「このアニメーションはどうやって動いているの???」という質問をかなり多く受けました。 もちろん、答えはかなり拍子抜けです。フレームバッファ/LCD...

CVE-2026-98156

A flaw was found in the Linux kernel. This vulnerability can lead to information disclosure when running a Xen paravirtualized PV guest. The virtio graphics driver virtio-gpu fails to use the Direct Memory Access DMA interface to translate memory addresses for the display framebuffer, passing raw...

SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2026:4024-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4024-1 advisory. This update for LibVNCServer fixes the following issue: - CVE-2026-50538: a malicious or man-in-the-middle VNC server can force a connecting...

SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2026:4022-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4022-1 advisory. This update for LibVNCServer fixes the following issue: - CVE-2026-50538: a malicious or man-in-the-middle VNC server c...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Do not accidentally unreference the same framebuffer multiple times due to deadlock handling. If a deadlock occurs after the fb lookup in drmmodepageflipioctl, we proceed to unreference the fb and then retry the entire proce...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fixed possible use after free in pxafbtask. In the pxafbprobe function, it calls the pxafbinitfbinfo function. After that, &fbi-task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Video: fbdev: amba-clcd: Fixed refcount leak issues. In clcdfbofinitdisplay, we should call ofnodeput for the references returned by ofgraphgetnextendpoint and ofgraphgetremoteportparent, as these references have increased the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbpm2fb: Avoid potential divide by zero errors In dofbioctl of fbmem.c, if cmd is FBIOPUTVSCREENINFO, var will be copied from the user. Then, the functions fbsetvar and info-fbops-fbcheckvar will be called, which might...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev/ep93xx-fb: Do not assign to struct fbinfo.dev. Do not assign the Linux device to struct fbinfo.dev. The call to registerframebuffer initializes the field to the fbdev device. Drivers should not override its value. Fixed a b...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Avoid using a null object of the framebuffer. Instead of directly using state-fb-obj0, obtain the object from the framebuffer by calling drmgemfbgetobj. Return an error code when the object is null to avoid using a nu...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fbdev: Added bounds checking in bitputcs to prevent out-of-bounds writes using vmalloc. Added bounds checking to prevent writes beyond the framebuffer boundaries when rendering text near the screen edges. Return early if the Y...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: The issue was fixed by correcting fbsetvar to prevent a null-ptr dereference in fbvideomodetovar. If fbaddvideomode in fbsetvar fails to allocate memory for fbvideomode, it may lead to a null-ptr dereference in...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tty: Fixed out-of-bound access to vmalloc in imageblit. This issue occurs when a user-space program calls ioctl FBIOPUTVSCREENINFO, passing the fbvarscreeninfo structure containing only the fields xres, yres, and bitsperpixel wit...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Makes the DPT object unshrinkable. In some scenarios, the DPT object is shrunk, but the actual framebuffer does not undergo any shrinkage. As a result, the DPT object remains in the DPT’s vm-boundlist. Then, an...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fbdeletevideomode is not based on the result of the previous fbconmodedeleted. As a result, the mode is directly deleted, regardless of whether it is still in us...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fixed an out-of-bounds write in fastimageblit. This issue occurs when a user-space program calls ioctl FBIOPUTCON2FBMAP by passing the console number and the frame buffer number. Ideally, this maps the console to the frame...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid using the null object of framebuffer. Instead of directly using state-fb-obj0, obtain the object from the framebuffer by calling drmgemfbgetobj. Return an error code when the object is null to avoid using t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: sh7760fb: A possible memory leak has been fixed in sh7760fballocmem. When information such as info-screenbase is not ready, calling sh7760fbfreemem does not release the memory correctly. Instead, call dmafreecoherent...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: In of: displaytiming, there is a fix for the refcount leak in ofgetdisplaytimings. The function ofparsephandle returns a devicenode with the refcount incremented. This value is stored in ‘entry’ and then copied to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fixed doregisterframebuffer to prevent null-ptr-dereference in fbvideomodetovar. If fbaddvideomode in doregisterframebuffer fails to allocate memory for fbvideomode, it will later lead to a null-ptr dereference in...