Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS

[Evgenii Shatokhin <eshatokhin () virtuozzo com>]

On 17.03.2021 18:17, Greg KH wrote:
> On Wed, Mar 17, 2021 at 07:45:59PM +0530, Rohit Keshri wrote:
> > Hello Team,
> >
> > A denial of service vulnerability was found in n_tty_receive_char_special
> > in drivers/tty/n_tty.c of the Linux kernel.  In this flaw a local attacker
> > with a normal user privilege could delay the loop (due to a changing
> > ldata->read_head, and a missing sanity check) and cause a threat to the
> > system availability.
> >
> > 'CVE-2021-20219' was assigned by Red Hat.
> >
> > Acknowledgements: Evgenii Shatokhin (Virtuozzo Research LLC)
>
> Really?  Not the tools or people that reported this issue and fixed it
> in the community back in 2018?

The description is misleading, unfortunately.

RedHat backported that original fix (commit 3d63b7e4ae0d "n_tty: Fix 
stall at n_tty_receive_char_special().") long ago.

I just found that their backport was incomplete: one hunk of the patch 
was lost. This lead to the problem I reported: the reproducer program 
caused n_tty_receive_char() to loop forever. As a result, other 
processes could hang too.

Regards,
Evgenii

> {sigh}
>
> greg k-h
> .