Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS

[Greg KH <greg () kroah com>]

On Wed, Mar 17, 2021 at 06:36:29PM +0300, Evgenii Shatokhin wrote:
> On 17.03.2021 18:17, Greg KH wrote:
> > On Wed, Mar 17, 2021 at 07:45:59PM +0530, Rohit Keshri wrote:
> > > Hello Team,
> > >
> > > A denial of service vulnerability was found in n_tty_receive_char_special
> > > in drivers/tty/n_tty.c of the Linux kernel.  In this flaw a local attacker
> > > with a normal user privilege could delay the loop (due to a changing
> > > ldata->read_head, and a missing sanity check) and cause a threat to the
> > > system availability.
> > >
> > > 'CVE-2021-20219' was assigned by Red Hat.
> > >
> > > Acknowledgements: Evgenii Shatokhin (Virtuozzo Research LLC)
> >
> > Really?  Not the tools or people that reported this issue and fixed it
> > in the community back in 2018?
>
> The description is misleading, unfortunately.
>
> RedHat backported that original fix (commit 3d63b7e4ae0d "n_tty: Fix stall
> at n_tty_receive_char_special().") long ago.
>
> I just found that their backport was incomplete: one hunk of the patch was
> lost. This lead to the problem I reported: the reproducer program caused
> n_tty_receive_char() to loop forever. As a result, other processes could
> hang too.

Ah, so the above text should have said "of the Red Hat Enterprise Linux
Kernel release XX.XX only", right?

Given that the above CVE is not public in any database that I can find,
one can only hope that the text will reflect what really is happening
here.  Rohit, why was this even published?

Again, stuff like this is just causing extra work by everyone else for
no good reason that I can see.

Rohit, PLEASE work on making these types of "announcements" reflect what
is actually happening.  I understand your company process rules require
the assignment of CVEs to issues to make things get resolved easier, but
that doesn't mean you should inflict that pain on the rest of the
world...

thanks,

gre gk-h