CVE-2023-52872

tty: n_gsm: fix race condition in status line change on dead connections

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: fix race condition in status line change on dead connections

gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs.

Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive.

Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	dd37f657387853623f20c1b2482afbb9cd8ece33 to before 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444Affected c568f7086c6e771c77aad13d727c70ef70e07243 to before df6cfab66ff2a44bd23ad5dd5309cb3421bb6593Affected c568f7086c6e771c77aad13d727c70ef70e07243 to before 19d34b73234af542cc8a218cf398dee73cdb1890Affected c568f7086c6e771c77aad13d727c70ef70e07243 to before ce4df90333c4fe65acb8b5089fdfe9b955ce976aAffected c568f7086c6e771c77aad13d727c70ef70e07243 to before 3a75b205de43365f80a33b98ec9289785da56243Affected d834aba5f30d9a6f98f4ca1eb07e501f1989331cAffected 692e847a8e6607909c4a3f98ab16ccee7849bd11Affected 5.15.61 to before 5.15.138Affected 5.18.18 to before 5.19Affected 5.19.2 to before 5.20Affected
LinuxLinux	6.0Affected before 6.0Not affected 5.15.138 through 5.15.Not affected 6.1.62 through 6.1.Not affected 6.5.11 through 6.5.Not affected 6.6.1 through 6.6.Not affected 6.7 and laterNot affected

Product

Versions

LinuxLinux

dd37f657387853623f20c1b2482afbb9cd8ece33 to before 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444Affected
c568f7086c6e771c77aad13d727c70ef70e07243 to before df6cfab66ff2a44bd23ad5dd5309cb3421bb6593Affected
c568f7086c6e771c77aad13d727c70ef70e07243 to before 19d34b73234af542cc8a218cf398dee73cdb1890Affected
c568f7086c6e771c77aad13d727c70ef70e07243 to before ce4df90333c4fe65acb8b5089fdfe9b955ce976aAffected
c568f7086c6e771c77aad13d727c70ef70e07243 to before 3a75b205de43365f80a33b98ec9289785da56243Affected
d834aba5f30d9a6f98f4ca1eb07e501f1989331cAffected
692e847a8e6607909c4a3f98ab16ccee7849bd11Affected
5.15.61 to before 5.15.138Affected
5.18.18 to before 5.19Affected
5.19.2 to before 5.20Affected

LinuxLinux

6.0Affected
before 6.0Not affected
5.15.138 through 5.15.*Not affected
6.1.62 through 6.1.*Not affected
6.5.11 through 6.5.*Not affected
6.6.1 through 6.6.*Not affected
6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.