In the Linux kernel, the following vulnerability has been resolved:
Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.
The commit above is reverted as it did not solve the original issue.
gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernelUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.198-187.748Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade perf | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade dtb-lgUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-rtUpgrade dtb-alteraUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-obs-buildUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade kernel-source-azureUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-azureUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade kernel-rtUpgrade dtb-nvidiaUpgrade dtb-qcomUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade kernel-devel-azureUpgrade dtb-armUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatchUpgrade dtb-caviumUpgrade kernel-rt-develUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade kernel-azure-develUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-source-rtUpgrade kernel-64kb-develUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade kernel-syms-rtUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade dlm-kmp-rtUpgrade kernel-64kbUpgrade dtb-socionextUpgrade kernel-default-baseUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-marvellUpgrade dtb-appleUpgrade dtb-amazonUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kselftests-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade kernel-symsUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade dtb-broadcom | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-nvidia-tegra-5.15Upgrade linux-oracle-5.15Upgrade linux-nvidia-tegraUpgrade linux-ibm-5.15Upgrade linux-awsUpgrade linux-lowlatencyUpgrade linux-gcp-fipsUpgrade linux-lowlatency-hwe-6.5Upgrade linux-intel-iot-realtimeUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-hwe-6.5Upgrade linux-laptopUpgrade linux-nvidia-tegra-igxUpgrade linux-gkeopUpgrade linux-gcp-6.5Upgrade linux-kvmUpgrade linux-fipsUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-xilinx-zynqmpUpgrade linux-ibmUpgrade linux-riscvUpgrade linux-azure-fdeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azureUpgrade linux-starfiveUpgrade linux-raspiUpgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-gkeop-5.15Upgrade linux-riscv-5.15Upgrade linux-oracle-6.5Upgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-nvidia-6.5Upgrade linux-gkeUpgrade linux-realtimeUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-oem-6.5 | Nov 19, 2024 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub