CVE-2022-2380: Linux Kernel DOS Vulnerability

CVE-2022-2380 Overview

CVE-2022-2380 is an out-of-bounds memory access vulnerability in the Linux kernel's Silicon Motion SM712 framebuffer driver. The flaw resides in the smtcfb_read() function located in drivers/video/fbdev/sm712fb.c. A local attacker with low privileges can trigger the condition to crash the kernel, resulting in a denial of service. The vulnerability is tracked under [CWE-125] (Out-of-Bounds Read) and [CWE-787] (Out-of-Bounds Write).

Critical Impact
Local attackers with low privileges can crash the Linux kernel by triggering out-of-bounds memory access in the sm712fb framebuffer driver, causing a system-wide denial of service.

Affected Products

Linux Kernel (versions containing drivers/video/fbdev/sm712fb.c prior to the upstream fix)
Linux distributions shipping the sm712fb framebuffer driver
Systems with the Silicon Motion SM712 framebuffer driver loaded

Discovery Timeline

2022-07-13 - CVE-2022-2380 published to the National Vulnerability Database (NVD)
2025-04-23 - Last updated in the NVD database

Technical Details for CVE-2022-2380

Vulnerability Analysis

The vulnerability exists in the smtcfb_read() function within the Silicon Motion SM712 framebuffer driver source file drivers/video/fbdev/sm712fb.c. The function fails to properly validate read boundaries against the underlying framebuffer memory region. When a local user issues a read() syscall against the framebuffer device, the driver can access memory outside the intended buffer.

The out-of-bounds access leads to a kernel crash, denying service to all users of the affected system. Exploitation requires local access and the ability to open the framebuffer device, which typically requires membership in a privileged group or appropriate device permissions.

The defect maps to two related CWE classifications: [CWE-125] for Out-of-Bounds Read and [CWE-787] for Out-of-Bounds Write. The issue does not provide a path to code execution or information disclosure based on the available impact metrics, but it does compromise system availability.

Root Cause

The root cause is missing or insufficient bounds checking on the offset and length parameters passed to smtcfb_read(). The function does not adequately constrain reads to the size of the framebuffer's mapped memory region before performing memory operations.

Attack Vector

An attacker requires local access to the system and read access to the framebuffer device node, typically /dev/fb0. By issuing a crafted read() system call with parameters that drive the offset or length beyond the framebuffer region, the attacker triggers the out-of-bounds access and crashes the kernel.

No verified public proof-of-concept code is associated with this CVE. The vulnerability mechanism is described in the upstream Kernel Git Commit Update that introduced the fix.

Detection Methods for CVE-2022-2380

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg referencing smtcfb_read or the sm712fb module
Sudden system reboots or hangs correlated with framebuffer device access by non-root users
Repeated failed read() operations against /dev/fb* device nodes from low-privilege user contexts

Detection Strategies

Inventory hosts running kernels that include the unpatched sm712fb.c source file and verify whether the sm712fb module is loaded with lsmod | grep sm712fb
Audit kernel ring buffer logs for oops signatures involving the sm712fb driver and the smtcfb_read symbol
Correlate process activity opening /dev/fb* devices with subsequent kernel instability events

Monitoring Recommendations

Forward dmesg and /var/log/kern.log entries to a centralized logging platform and alert on BUG:, Oops:, or general protection fault messages tied to framebuffer symbols
Monitor unprivileged process access to framebuffer device nodes using Linux audit rules on /dev/fb0 and related paths
Track kernel module load events for sm712fb on systems where this hardware is not present, as the module should not be active

How to Mitigate CVE-2022-2380

Immediate Actions Required

Apply the upstream Linux kernel patch referenced in the Kernel Git Commit Update or upgrade to a distribution kernel that includes commit bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8
Restrict access to framebuffer device nodes by tightening permissions on /dev/fb* and limiting membership in the video group
Blacklist the sm712fb kernel module on systems that do not require Silicon Motion SM712 framebuffer support

Patch Information

The upstream fix is committed to the linux-fbdev tree maintained by Helge Deller. Distribution maintainers have backported the change into stable kernel branches. Verify your kernel version against your distribution's security advisories and apply vendor-supplied updates. Reference: Kernel Git Commit Update.

Workarounds

Unload the affected driver with rmmod sm712fb and prevent it from loading at boot by adding blacklist sm712fb to /etc/modprobe.d/blacklist.conf
Remove or tighten permissions on framebuffer device nodes so only root can read from them on systems where unprivileged framebuffer access is not required
Limit local shell access on multi-user systems to reduce the population of accounts capable of triggering the flaw

bash

# Configuration example: blacklist the vulnerable framebuffer driver
echo 'blacklist sm712fb' | sudo tee /etc/modprobe.d/blacklist-sm712fb.conf
sudo rmmod sm712fb 2>/dev/null || true
sudo update-initramfs -u

# Restrict framebuffer device access to root only
sudo chmod 600 /dev/fb*