Vulnerability in Kernel package: tty: goldfish: Use tty_port_destroy() to destroy port
Summary
GSD-2022-1003974: tty: goldfish: Use tty_port_destroy() to destroy port. Affects Kernel versions >= 666b7793d4bfa9f150b5c2007ab48c755ddc53ca, < 241fcb79dd1df276d80b19f5f6acc9eaaaa63309. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functions and providing an interface between hardware and software. It includes various subsystems, including the tty subsystem, which handles terminal input and output. The goldfish driver within the tty subsystem is specifically designed for the Android emulator. This vulnerability affects the goldfish driver and its handling of port destruction.
Vulnerability Detail
The vulnerability arises from the improper destruction of ports in the goldfish driver within the tty subsystem. Instead of using the appropriate function tty_port_destroy(), the driver uses an incorrect method, potentially leading to resource leaks and other security issues. While the impact and attack plausibility have not been proven, this vulnerability could potentially be exploited to gain unauthorized access or cause system instability. The vulnerability was introduced in version v3.9 of the Linux Kernel and has been fixed in version v4.14.283.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from using the goldfish driver within the tty subsystem. However, this may not be feasible in certain scenarios, such as when utilizing the Android emulator. In such cases, it is crucial to apply the recommended fix by updating the Kernel to the patched version.
Conclusion
In conclusion, the Kernel package's goldfish driver within the tty subsystem is vulnerable to improper port destruction. This vulnerability can be mitigated by updating the Kernel to version v4.14.283 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, responsible for managing core functions and acting as an interface between hardware and software.
The tty subsystem in the Kernel handles terminal input and output, providing an interface for user interaction with the system.
The goldfish driver is a specific driver within the tty subsystem, designed for the Android emulator.
The vulnerability could potentially be exploited to gain unauthorized access or cause system instability. However, the actual impact and attack plausibility have not been proven.
To fix this vulnerability, it is necessary to update the Linux Kernel to version v4.14.283 or later by obtaining the updated Kernel source code and compiling it for the target system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
