Index: FreeBSD-EN-23:21.tty =================================================================== --- /dev/null +++ FreeBSD-EN-23:21.tty @@ -0,0 +1,112 @@ +============================================================================= +FreeBSD-EN-23:21.tty Errata Notice + The FreeBSD Project + +Topic: tty(4) IUTF8 causes a kernel panic + +Category: core +Module: tty +Announced: 2023-11-24 +Affects: FreeBSD 14.0-RELEASE +Corrected: 2023-11-20 16:54:54 UTC (stable/14, 14.0-STABLE) + 2023-XX-XX XX:XX:XX UTC (releng/14.0, 14.0-RELEASE-pXX) + 2023-11-20 16:57:49 UTC (stable/13, 13.2-STABLE) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +. + +I. Background + +The IUTF8 flag was added to the tty(4) driver in order to add proper +backspace handling for UTF-8 characters. Without this flag, tty(4) +treats all characters as single-byte-wide characters and so, in the case +of a UTF-8 character larger than two bytes, tty(4) deletes only one byte +during a backspace event, instead of all bytes, which results in the tty +buffer containing garbage. + +II. Problem Description + +The implementation of backspace handling failed to check whether the TTY +buffer was empty, in which case the kernel could panic. + +III. Impact + +An unprivileged user may be able to trigger a kernel panic. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security branch +(releng) dated after the correction date, and reboot. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, +or the i386 platfrom on FreeBSD 13 and earlier, can be updated via +the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-23:XX/iutf8.patch +# fetch https://security.FreeBSD.org/patches/EN-23:XX/iutf8.patch.asc +# gpg --verify iutf8.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in + and reboot the +system. + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +------------------------------------------------------------------------- +stable/14/ ae8387cc818a stable/14-n265760 +releng/14.0/ XXXXXXXXXXXX releng/14.0-nXXXXXX +stable/13/ 8647fe60b8c3 stable/13-n256709 +------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + + + + +The latest revision of this advisory is available at +