Description
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
93857edd9829e144acb6c7e72d593f6e01aead66 to < 15ddaf908a8eee14e1872ff9c4cdb73562634e7eaffected93857edd9829e144acb6c7e72d593f6e01aead66 to < bcb9b5df70d439f3c9d5a2d7f359dd7ab117bee0affected93857edd9829e144acb6c7e72d593f6e01aead66 to < 33048616c4e22930e8769b8d14ee8a0dc5a80cebaffected93857edd9829e144acb6c7e72d593f6e01aead66 to < 6b4e15cccfbe03b7c6ae60ff570c401bfb1e51d6affected93857edd9829e144acb6c7e72d593f6e01aead66 to < 1572d86bcf0bcb848d20fc5e5de7ed6963034c2baffected93857edd9829e144acb6c7e72d593f6e01aead66 to < 08bf919f041af9de372428bb0c938157ea144164affected93857edd9829e144acb6c7e72d593f6e01aead66 to < dcaf0251f847a45861e94c6617024a9455687d2faffected93857edd9829e144acb6c7e72d593f6e01aead66 to < 8df07fe93573e9e548d6645273e9bcb6eb74059eaffected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/15ddaf908a8eee14e1872ff9c4cdb73562634e7e ↗
- https://git.kernel.org/stable/c/bcb9b5df70d439f3c9d5a2d7f359dd7ab117bee0 ↗
- https://git.kernel.org/stable/c/33048616c4e22930e8769b8d14ee8a0dc5a80ceb ↗
- https://git.kernel.org/stable/c/6b4e15cccfbe03b7c6ae60ff570c401bfb1e51d6 ↗
- https://git.kernel.org/stable/c/1572d86bcf0bcb848d20fc5e5de7ed6963034c2b ↗
- https://git.kernel.org/stable/c/08bf919f041af9de372428bb0c938157ea144164 ↗
- https://git.kernel.org/stable/c/dcaf0251f847a45861e94c6617024a9455687d2f ↗
- https://git.kernel.org/stable/c/8df07fe93573e9e548d6645273e9bcb6eb74059e ↗