Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2023-52872

tty: n_gsm: fix race condition in status line change on dead connections

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix race condition in status line change on dead connections gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs. Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive. Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • dd37f657387853623f20c1b2482afbb9cd8ece33 to < 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444affected
  • c568f7086c6e771c77aad13d727c70ef70e07243 to < df6cfab66ff2a44bd23ad5dd5309cb3421bb6593affected
  • c568f7086c6e771c77aad13d727c70ef70e07243 to < 19d34b73234af542cc8a218cf398dee73cdb1890affected
  • c568f7086c6e771c77aad13d727c70ef70e07243 to < ce4df90333c4fe65acb8b5089fdfe9b955ce976aaffected
  • c568f7086c6e771c77aad13d727c70ef70e07243 to < 3a75b205de43365f80a33b98ec9289785da56243affected
  • d834aba5f30d9a6f98f4ca1eb07e501f1989331caffected
  • 692e847a8e6607909c4a3f98ab16ccee7849bd11affected
  • 5.15.61 to < 5.15.138affected
  • 5.18.18 to < 5.19affected
  • 5.19.2 to < 5.20affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 5.15.138 to ≤ 5.15.*unaffected
  • 6.1.62 to ≤ 6.1.*unaffected
  • 6.5.11 to ≤ 6.5.*unaffected
  • 6.6.1 to ≤ 6.6.*unaffected
  • 6.7 to ≤ *unaffected

References