CVE-2015-4170: Race Condition
An issue was discovered in the linux kernel's tty subsystem handling during shutdown. The flaw was possible to take a reference to the ldisc during shutdown phase.
This race occurs on hangup of tty. It races and hangs on ldsemdownwrite on a semaphore that is being aquired by a new reader(CPU 1). The new reader/writer is sleeping in ldsemdownread() and the hangup is sleeping in ldsemdownwrite().
Resources:
Fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf872776fc84128bb779ce2b83a37c884c3203ae CVE request: http://seclists.org/oss-sec/2015/q2/545
Other sources
Race condition in the ldsemcmpxchg function in drivers/tty/ttyldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsemdownread and ldsemdownwrite deadlock) by establishing a new tty thread during shutdown of a previous tty thread.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4170?
CVE-2015-4170 has a medium severity rating due to its capability to cause a denial of service.
How do I fix CVE-2015-4170?
To mitigate CVE-2015-4170, it is recommended to update the Linux kernel to version 3.13.4 or later.
Which versions of the Linux kernel are affected by CVE-2015-4170?
CVE-2015-4170 affects Linux kernel versions prior to 3.13.4.
What type of attack does CVE-2015-4170 exploit?
CVE-2015-4170 exploits a race condition during the shutdown of tty threads.
Can local users exploit CVE-2015-4170?
Yes, local users can exploit CVE-2015-4170 to create a denial of service condition.