Deadlock Vulnerability in Linux Kernel
Summary
GSD-2022-1003474: drivers: tty: serial: Fix deadlock in sa1100_set_termios(). Affects Kernel versions < 6e2273eefab54a521d9c59efb6e1114e742bdf41. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It consists of various subsystems, including the TTY (teletypewriter) subsystem, which handles terminal input and output. The TTY subsystem includes drivers for serial communication, such as the sa1100 driver. This vulnerability specifically affects the sa1100_set_termios() function in the serial driver, which is responsible for setting terminal I/O attributes for the sa1100 serial port.
Vulnerability Detail
The sa1100_set_termios() function in the sa1100 serial driver in the Linux Kernel is susceptible to a deadlock. This vulnerability can be triggered when multiple processes attempt to set terminal I/O attributes simultaneously. The deadlock occurs due to a race condition in the locking mechanism used by the function. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition or disrupt the normal operation of the affected system. The vulnerability has been fixed in Linux Kernel version v5.10.122 by commit 6e2273eefab54a521d9c59efb6e1114e742bdf41.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the deadlock by ensuring that only one process at a time attempts to set terminal I/O attributes for the sa1100 serial port. This can be achieved by implementing proper synchronization mechanisms, such as using locks or semaphores, to serialize access to the sa1100_set_termios() function.
Conclusion
In conclusion, the Linux Kernel sa1100 serial driver is vulnerable to a deadlock issue in the sa1100_set_termios() function. This vulnerability can be mitigated by updating the Linux Kernel to version v5.10.122 or later. Alternatively, users can implement the suggested workaround to avoid triggering the deadlock. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a deadlock, causing a denial-of-service condition or disruption of normal system operation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will analyze the dependencies for any known vulnerabilities.
Yes, the vulnerability has been fixed in Linux Kernel version v5.10.122 by commit 6e2273eefab54a521d9c59efb6e1114e742bdf41.
Yes, you can implement the suggested workaround mentioned earlier to avoid triggering the deadlock.
You can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003474.json) for more information.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
