The Linux 5.3 kernel includes modifications adding extra protection for ioctl calls related to the floppy driver, which itself is marked as orphaned
('orphaned'), meaning that its testing has ceased.
The driver is considered obsolete, as it is difficult to find functional hardware for its testing—most current external drives typically use the USB interface. However, the removal of the driver from the kernel is hindered by the fact that floppy disk controllers are still emulated in virtualization systems. Therefore, the driver remains in the kernel for now, but its proper functionality is not guaranteed.
Additionally, the floppy driver (), which allows an unprivileged user, capable of inserting their own floppy disk, to read data from memory areas outside the bounds of the copy buffer (for example, adjacent areas may contain residual data from the disk cache and input buffer). On one hand, the vulnerability remains relevant since the floppy driver is automatically loaded when a corresponding emulated controller is present in virtualization systems (for instance, it is used by default in QEMU), but on the other hand, to exploit the issue, a specially crafted floppy disk image prepared by an attacker must be connected.
Source: opennet.ru
