In the Linux kernel, the following vulnerability has been resolved:
Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.
The commit above is reverted as it did not solve the original issue.
gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.198-187.748Upgrade kernelUpgrade kernel-headers | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade reiserfs-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade kernel-rtUpgrade dtb-caviumUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-rt-vdsoUpgrade dtb-exynosUpgrade kernel-azure-develUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade kernel-rt-develUpgrade gfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-develUpgrade dtb-xilinxUpgrade kernel-azureUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-rt_debug-develUpgrade dtb-nvidiaUpgrade kernel-syms-azureUpgrade dtb-mediatekUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-amlogicUpgrade dtb-rockchipUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade dtb-armUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-rt-extraUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kernel-kvmsmallUpgrade dtb-allwinnerUpgrade kernel-default-extraUpgrade dtb-apmUpgrade dtb-marvellUpgrade kernel-debug-develUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade kernel-symsUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-hisiliconUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-docsUpgrade dtb-broadcomUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-syms-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-extraUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-default-baseUpgrade kernel-64kbUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-default-develUpgrade kernel-defaultUpgrade kernel-azure-extraUpgrade kernel-64kb-devel | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-riscv-5.15Upgrade linux-gkeUpgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-azure-fdeUpgrade linux-intel-iotg-5.15Upgrade linux-riscvUpgrade linux-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-hwe-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-kvmUpgrade linux-gcpUpgrade linux-oem-6.5Upgrade linux-starfiveUpgrade linux-nvidiaUpgrade linux-azureUpgrade linux-nvidia-6.5Upgrade linux-aws-5.15Upgrade linux-oracle-6.5Upgrade linux-intel-iotgUpgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-gkeop-5.15Upgrade linux-ibmUpgrade linux-fipsUpgrade linux-hwe-6.5Upgrade linux-intel-iot-realtimeUpgrade linuxUpgrade linux-lowlatency-hwe-6.5Upgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-lowlatencyUpgrade linux-nvidia-tegra-5.15Upgrade linux-gkeopUpgrade linux-oracle-5.15Upgrade linux-gcp-fipsUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegraUpgrade linux-awsUpgrade linux-gcp-6.5Upgrade linux-laptop | Nov 19, 2024 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub