Deadlock Vulnerability in Linux Kernel
Summary
GSD-2022-1003039: tty: fix deadlock caused by calling printk() under tty_port->lock. Affects Kernel versions >= b6da31b2c07c46f2dcad1d86caa835227a16d9ff, < b3c974501d0c32258ae0e04e5cc3fb92383b40f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionalities. It serves as an interface between the hardware and software layers, enabling communication and coordination between various system components. The tty (teletypewriter) subsystem within the Linux Kernel handles input and output operations for terminal devices. It allows users to interact with the system through terminals or virtual consoles. The tty subsystem relies on the tty_port structure to manage the state and configuration of terminal ports. However, a vulnerability has been identified in the Linux Kernel's tty subsystem that can lead to a deadlock when calling printk() under tty_port->lock.
Vulnerability Detail
The identified vulnerability in the Linux Kernel's tty subsystem arises from a deadlock situation caused by invoking printk() while holding the tty_port->lock. This can occur when a process attempts to print kernel messages using printk() while the tty_port->lock is already held. As a result, the process becomes blocked, leading to a deadlock scenario. Deadlocks can severely impact system performance and stability, potentially resulting in system crashes or unresponsiveness. The vulnerability was introduced in version v4.18 of the Linux Kernel and has been fixed in version v5.17.14 through commit b3c974501d0c32258ae0e04e5cc3fb92383b40f6.
How To Fix
No fixed version is published for this vulnerability.
To fix the deadlock vulnerability in the Linux Kernel's tty subsystem, it is recommended to update to the latest version of the Linux Kernel (v5.17.14 or later) that includes the fix commit b3c974501d0c32258ae0e04e5cc3fb92383b40f6. Updating the kernel ensures that the deadlock scenario is properly handled, preventing potential system crashes or unresponsiveness.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the deadlock by refraining from invoking printk() while holding the tty_port->lock. Instead, it is advisable to release the lock before calling printk() to prevent the potential deadlock situation. Here's an example of how to implement the workaround in C code:
// Release the tty_port->lock before calling printk()
spin_unlock(&tty_port->lock);
printk("Kernel message");
spin_lock(&tty_port->lock);
Conclusion
In conclusion, the identified deadlock vulnerability in the Linux Kernel's tty subsystem can lead to system crashes or unresponsiveness. It is recommended to update to the latest version of the Linux Kernel (v5.17.14 or later) that includes the fix commit b3c974501d0c32258ae0e04e5cc3fb92383b40f6. Alternatively, users can apply the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a deadlock scenario in the Linux Kernel's tty subsystem, potentially causing system crashes or unresponsiveness.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in the Linux Kernel version v5.17.14 through commit b3c974501d0c32258ae0e04e5cc3fb92383b40f6. It is recommended to update to this version or a later one to mitigate the vulnerability.
Yes, a workaround is available for this vulnerability. By releasing the tty_port->lock before calling printk() and reacquiring it afterward, you can avoid triggering the deadlock scenario.
At the time of this report, no known exploits for this vulnerability have been identified. However, it is crucial to apply the fix or workaround to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.