Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Mar 2021 18:36:29 +0300
From: Evgenii Shatokhin <>
To: Greg KH <>
Subject: Re: CVE-2021-20219 Linux kernel: improper
 synchronization in flush_to_ldisc() can lead to DoS

On 17.03.2021 18:17, Greg KH wrote:
> On Wed, Mar 17, 2021 at 07:45:59PM +0530, Rohit Keshri wrote:
>> Hello Team,
>> A denial of service vulnerability was found in n_tty_receive_char_special
>> in drivers/tty/n_tty.c of the Linux kernel.  In this flaw a local attacker
>> with a normal user privilege could delay the loop (due to a changing
>> ldata->read_head, and a missing sanity check) and cause a threat to the
>> system availability.
>> 'CVE-2021-20219' was assigned by Red Hat.
>> Acknowledgements: Evgenii Shatokhin (Virtuozzo Research LLC)
> Really?  Not the tools or people that reported this issue and fixed it
> in the community back in 2018?

The description is misleading, unfortunately.

RedHat backported that original fix (commit 3d63b7e4ae0d "n_tty: Fix 
stall at n_tty_receive_char_special().") long ago.

I just found that their backport was incomplete: one hunk of the patch 
was lost. This lead to the problem I reported: the reproducer program 
caused n_tty_receive_char() to loop forever. As a result, other 
processes could hang too.


> {sigh}
> greg k-h
> .

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.