Vulnerability in Kernel package: tty: goldfish: Use tty_port_destroy() to destroy port
Summary
GSD-2022-1003741: tty: goldfish: Use tty_port_destroy() to destroy port. Affects Kernel versions >= 666b7793d4bfa9f150b5c2007ab48c755ddc53ca, < 9ae3d073f7db5578ae1907544f0c15947e9678e6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functions. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying system resources. The tty subsystem within the Kernel package handles terminal input and output, facilitating communication with devices such as serial ports and terminals. The goldfish driver is a specific component within the tty subsystem that emulates a serial port for the Android emulator. This vulnerability specifically affects the goldfish driver in the tty subsystem.
Vulnerability Detail
The vulnerability arises from the improper destruction of the tty port in the goldfish driver. Instead of using the appropriate function, tty_port_destroy(), to destroy the port, an incorrect method is employed. This flaw can potentially lead to resource leaks and other security issues. Although the exact impact and attack vectors have not been proven, it is crucial to address this vulnerability to ensure the stability and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually modify the affected code in the goldfish driver to use tty_port_destroy() instead of the incorrect method. Here is an example of the modified code:
// Original code
...
incorrect_destroy_port(port);
...
// Modified code
...
tty_port_destroy(port);
...
Conclusion
In conclusion, the Kernel package's goldfish driver in the tty subsystem is vulnerable due to the improper destruction of the tty port. To mitigate this vulnerability, it is crucial to update the Linux Kernel package to the recommended version or apply the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing core system functions and providing an interface between hardware and software layers.
The tty subsystem is a component within the Kernel package that handles terminal input and output, facilitating communication with devices like serial ports and terminals.
The goldfish driver is a specific component within the tty subsystem that emulates a serial port for the Android emulator.
The exact impact and attack vectors have not been proven, but this vulnerability can potentially lead to resource leaks and other security issues.
To fix this vulnerability, update the Linux Kernel package to version v5.4.198 or later, which includes the necessary fix committed in 9ae3d073f7db5578ae1907544f0c15947e9678e6.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
