CVE-2024-40966: tty: add the option to have a tty reject a new ldisc
In the Linux kernel, the following vulnerability has been resolved:
tty: add the option to have a tty reject a new ldisc
... and use it to limit the virtual terminals to just NTTY. They are kind of special, and in particular, the "conwrite()" routine violates the "writes cannot sleep" rule that some ldiscs rely on.
This avoids the
BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659
when NGSM has been attached to a virtual console, and gsmldwrite() calls conwrite() while holding a spinlock, and conwrite() then tries to get the console lock.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40966?
CVE-2024-40966 has a moderate severity rating due to its impact on terminal behavior.
How do I fix CVE-2024-40966?
To fix CVE-2024-40966, update the Linux kernel to version 6.1.96 or later, or apply the appropriate patches if available.
Which systems are affected by CVE-2024-40966?
CVE-2024-40966 affects various Linux systems that utilize specific kernel versions, particularly Red Hat and Debian distributions.
What are the potential impacts of CVE-2024-40966?
The potential impacts of CVE-2024-40966 include malicious manipulation of terminal functionalities, leading to security risks.
Is CVE-2024-40966 exploitable remotely?
CVE-2024-40966 is not directly exploitably remotely but could impact system security configurations if user access is compromised.