CVE-2022-50116

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: fix deadlock and link starvation in outgoing data path

The current implementation queues up new control and user packets as needed

and processes this queue down to the ldisc in the same code path.

That means that the upper and the lower layer are hard coupled in the code.

Due to this deadlocks can happen as seen below while transmitting data,

especially during ldisc congestion. Furthermore, the data channels starve

the control channel on high transmission load on the ldisc.

Introduce an additional control channel data queue to prevent timeouts and

link hangups during ldisc congestion. This is being processed before the

user channel data queue in gsm_data_kick(), i.e. with the highest priority.

Put the queue to ldisc data path into a workqueue and trigger it whenever

new data has been put into the transmission queue. Change

gsm_dlci_data_sweep() accordingly to fill up the transmission queue until

TX_THRES

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References