Описание
In the Linux kernel, the following vulnerability has been resolved:
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
kbd_keycode() reads vc->port.tty without acquiring a tty reference,
racing against con_shutdown() which clears port.tty under a different
lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference
for the duration the tty pointer is needed.
A flaw was found in the Linux kernel. A race condition exists in the kbd_keycode() function within the virtual terminal (vt) subsystem. This occurs when kbd_keycode() attempts to read a terminal (tty) reference without properly acquiring and holding it, while the con_shutdown() function can concurrently clear the same reference. This timing vulnerability can lead to a use-after-free condition, potentially causing system instability or a denial of service (DoS) for a local attacker.
Отчет
A MODERATE severity race condition was found in the Linux kernel virtual terminal (vt) subsystem. The kbd_keycode() function reads the vc->port.tty pointer without acquiring a tty reference, while con_shutdown() can concurrently clear that same pointer under a different lock, leaving a window in which the tty pointer becomes stale. A local attacker with access to the console/virtual terminal path, who can combine keyboard input with virtual terminal tty state changes, could win this race and trigger a use-after-free, causing a kernel crash and local denial of service; the flaw is not network-reachable. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2, are affected. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. The fix is currently deferred for the affected streams rather than scheduled for an immediate update, so the race window remains; the residual risk is limited to the local availability impact (system crash/denial of service) that results from exploiting the tty object lifetime race. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the demonstrated impact is a local denial of service, whereas the upstream CVE record scores it 7.8 (IMPORTANT) by additionally crediting high confidentiality and integrity impact; Red Hat's assessment reflects that the practical consequence of this race is loss of availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In the Linux kernel, the following vulnerability has been resolved: v ...
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
5.5 Medium
CVSS3