Deadlock Vulnerability in Linux Kernel
Summary
GSD-2022-1004003: tty: fix deadlock caused by calling printk() under tty_port->lock. Affects Kernel versions >= deb1feaad03a78b545c949e54582ae57b3c56982, < 4c253caf9264d2aa47ee806a87986dd8eb91a5d9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, facilitating communication between software and hardware components. The tty subsystem within the Linux Kernel is responsible for handling terminal devices, including serial ports and virtual consoles. It allows user applications to interact with these devices.
The vulnerability identified in the Linux Kernel relates to a deadlock situation that can occur when the printk() function is called under the tty_port->lock. This lock is used to synchronize access to the tty port data structure. The deadlock arises due to the fact that printk() itself acquires locks, leading to a circular dependency scenario. This vulnerability can potentially impact systems utilizing the affected versions of the Linux Kernel.
Vulnerability Detail
The deadlock vulnerability in the Linux Kernel arises when the printk() function is invoked under the tty_port->lock. This can result in a situation where multiple threads or processes are waiting for locks, leading to a deadlock. Deadlocks can cause system instability, unresponsiveness, and potential denial-of-service conditions. The vulnerability was introduced in version v4.14.60 of the Linux Kernel and is fixed in version v4.14.283.
To exploit this vulnerability, an attacker would need the ability to execute code on a system running the affected Linux Kernel version and trigger the deadlock condition by calling printk() under the tty_port->lock. The impact of this vulnerability may vary depending on the specific system configuration and usage patterns.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. The recommended approach is to apply the fix by updating to the latest version of the Linux Kernel.
Conclusion
The deadlock vulnerability in the Linux Kernel, introduced in version v4.14.60 and fixed in version v4.14.283, can lead to system instability and potential denial-of-service conditions. It is crucial for users to update their Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability may vary depending on the specific system configuration and usage patterns. In some cases, it can lead to system instability, unresponsiveness, and potential denial-of-service conditions.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
No, this vulnerability requires the ability to execute code on a system running the affected Linux Kernel version. It cannot be exploited remotely without prior access to the target system.
The recommended mitigation is to update to the latest version of the Linux Kernel, which includes the fix for this vulnerability. It is important to ensure that the updated version is applied to all affected systems.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is always recommended to apply security updates promptly to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
