tty: abort break signalling on hangup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should still be aborted to avoid calling back into the driver after a user-controlled timeout (possibly even after the tty has been reopened). Note that drivers should disable any break state on shutdown so just return on hangup (calling break_ctl() again is racy and will most likely fail for drivers handling the race).
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From f34d7a5b7010b82fe97da95496b9971435530062 · fixed in 6c9c9367351a461d62e5c0a39bffdcfbb40f068b; From f34d7a5b7010b82fe97da95496b9971435530062 · fixed in 3bc82999fb85cecc7eb6ec1755ee7d698aa1e783; From f34d7a5b7010b82fe97da95496b9971435530062 · fixed in 94af6cd832e9b4ce39a8fb59144a8f09ab56fd35; From f34d7a5b7010b82fe97da95496b9971435530062 · fixed in c8ccd3b2013daaf77b98f8a6724fcf4d2c5c52d6; From f34d7a5b7010b82fe97da95496b9971435530062 · fixed in 845a2737e0f5ffe5ca8d38de556012b0c9472cdd
- Linux Linux
2.6.26
- KernelLinux
From 2.6.26 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10