In the Linux kernel, the following vulnerability has been resolved:
tty: fix possible null-ptr-defer in spk_ttyio_release
Run the following tests on the qemu platform:
syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe
spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow:
syzkaller:~# modprobe -r speakup_audptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutex_lock+0x14/0x30 Call Trace: <TASK> spk_ttyio_release+0x19/0x70 [speakup] synth_release.part.6+0xac/0xc0 [speakup] synth_remove+0x56/0x60 [speakup] __x64_sys_delete_module+0x156/0x250 ? fpregs_assert_state_consistent+0x1d/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer:
in_synth->dev was not initialized during modprobe, so we add check for in_synth->dev to fix this bug.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Aug 22, 2024 | Aug 22, 2024 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-intel-iot-realtimeUpgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-riscv-5.15Upgrade linux-gcpUpgrade linux-gkeUpgrade linux-aws-5.15Upgrade linuxUpgrade linux-azure-5.15Upgrade linux-azure-fde-5.15Upgrade linux-oracleUpgrade linux-gcp-5.15Upgrade linux-kvmUpgrade linux-azure-fdeUpgrade linux-realtimeUpgrade linux-intel-iotg-5.15Upgrade linux-raspiUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-ibmUpgrade linux-azureUpgrade linux-gkeop-5.15Upgrade linux-gkeop | Nov 19, 2024 | Aug 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub