CVE-2021-47383: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47383 is a vulnerability in the Linux kernel's TTY subsystem that was discovered and disclosed in 2021. The issue occurs when a userspace program performs an ioctl FBIOPUT_VSCREENINFO operation, passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values (Kernel Commit).

The vulnerability arises when the same fb_var_screeninfo struct is passed in consecutive ioctl calls. If the struct remains unchanged, the vc_resize() function detects this and skips calling resize_screen(), leaving the fb_var_screeninfo incomplete. This leads to updatescrollmode() calculating an incorrect value for fbcon_display->vrows, which causes real_y() to return a wrong y value, ultimately resulting in imageblit accessing an out-of-bounds address value (Kernel Commit).

This vulnerability is rated as moderate severity as it can lead to system crashes by accessing invalid memory addresses. However, it does not pose a direct threat to data security or allow unauthorized access (Red Hat CVE).

The vulnerability requires local access to the system and the ability to execute the specific ioctl operations on the framebuffer device. It has been confirmed to be exploitable through userspace programs that can manipulate framebuffer settings (Red Hat CVE).

The issue has been fixed by modifying the resize_screen() function to be called even when the screen does not need resizing, ensuring the fb_var_screeninfo is properly initialized. Users are advised to update their systems with the latest kernel patches that include this fix (Kernel Commit).