Deadlock Vulnerability in Linux Kernel
Summary
GSD-2022-1004062: tty: fix deadlock caused by calling printk() under tty_port->lock. Affects Kernel versions >= d83904cb2eb2c4d937eaf15032214b0578f25099, < 4af21b12a60ed2d3642284f4f85b42d7dc6ac246. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system. It provides essential functionality for managing hardware, running processes, and facilitating communication between software and hardware components. The tty subsystem in the Linux Kernel is responsible for handling terminal devices and serial ports. It allows users to interact with the system through command-line interfaces. The tty subsystem utilizes the tty_port structure to manage the state and operations of terminal devices. However, a vulnerability has been discovered in the tty subsystem that can lead to a deadlock when calling printk() under tty_port->lock.
Vulnerability Detail
The vulnerability arises from a deadlock situation caused by calling printk() while holding the tty_port->lock. This can occur when a process attempts to print kernel messages using printk() while the tty_port->lock is already held. As a result, the process becomes stuck in a deadlock, preventing further execution and potentially impacting system stability. The vulnerability was introduced in Linux Kernel version v4.9.117 and has been fixed in version v4.9.318.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the deadlock by ensuring that no printk() calls are made while holding the tty_port->lock. This can be achieved by carefully reviewing and modifying the code that utilizes printk() in the context of the tty subsystem. Here is an example of how to avoid the deadlock:
// Bad code:
void my_function()
{
spin_lock(&tty_port->lock);
printk("Hello, world!");
spin_unlock(&tty_port->lock);
}
// Fixed code:
void my_function()
{
printk("Hello, world!");
}
Conclusion
In conclusion, a deadlock vulnerability has been identified in the Linux Kernel's tty subsystem. This vulnerability can lead to processes becoming stuck and potentially impacting system stability. It is recommended to update the Linux Kernel to version v4.9.318 or later to fix this issue. Alternatively, users can apply the provided workaround by modifying the code to avoid calling printk() while holding the tty_port->lock. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a deadlock situation, causing processes to become stuck and potentially impacting system stability. It can also hinder the ability to print kernel messages, which may be crucial for debugging and monitoring purposes.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
At the time of this report, no known exploits for this vulnerability have been disclosed. However, it is important to promptly apply the fix to mitigate any potential risks.
No, this vulnerability requires local access to the system in order to trigger the deadlock situation. It cannot be exploited remotely over a network.
Modifying the code to avoid calling printk() while holding the tty_port->lock is the recommended workaround. However, if modifying the code is not feasible, ensuring that no other processes hold the tty_port->lock while calling printk() can also help mitigate the risk of deadlock.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
