deadsimple BSD Security Advisories and Announcements

FreeBSD Errata Notice FreeBSD-EN-23:21.tty

Hash: SHA512

FreeBSD-EN-23:21.tty                                            Errata Notice
                                                          The FreeBSD Project

Topic:          tty(4) IUTF8 causes a kernel panic

Category:       core
Module:         tty
Announced:      2023-11-24
Affects:        FreeBSD 14.0
Corrected:      2023-11-20 16:54:54 UTC (stable/14, 14.0-STABLE)
                2023-12-05 18:27:38 UTC (releng/14.0, 14.0-RELEASE-p2)
                2023-11-20 16:57:49 UTC (stable/13, 13.2-STABLE)

For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit

Note: This issue does not affect 13.2-RELEASE, as the bug was introduced into
the stable/13 branch after the 13.2 release.

I.   Background

The IUTF8 flag was added to the tty(4) subsystem in order to add proper
backspace handling for UTF-8 characters.  Without this flag, tty(4) treats
all characters as single-byte-wide characters and so, in the case of a UTF-8
character two bytes in size or larger, tty(4) deletes only one byte during a
backspace event, instead of all bytes, which results in the tty buffer
containing garbage.

II.  Problem Description

The implementation of backspace handling failed to check whether the TTY
buffer was empty, in which case the kernel could panic.

III. Impact

An unprivileged user may be able to trigger a kernel panic.

IV.  Workaround

No workaround is available.

V.   Solution

Upgrade your system to a supported FreeBSD stable or release / security branch
(releng) dated after the correction date, and reboot.

Perform one of the following:

1) To update your system via a binary patch:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

2) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch
# fetch
# gpg --verify tty.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:> and reboot the

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash or Subversion
revision number in the following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              ae8387cc818a	stable/14-n265760
releng/14.0/                            31f6cfca851f  releng/14.0-n265392
stable/13/                              8647fe60b8c3	stable/13-n256709
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:


To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References


The latest revision of this advisory is available at