CAN-2004-0814: Linux terminal layer races

[Alan Cox <alan@xxxxxxxxxxxxxxxxxxx>]

Linux 2.6.9 fixes a set of race conditions in the Linux terminal
subsystem which are believed to go back to 2.2 kernels if not earlier.
The race shows up problematically in two places.

Firstly a user can cause crashes and other undefined behaviour by
issuing a TIOCSETLD ioctl on a terminal interface while another thread
is performing read or write operations. This was initially reported to
Linux kernel with a small demonstration application. By careful choice
of line disciplines it is sometimes possible to access small random
amounts of kernel data.

The second case is more problematic in some ways as it is an external
attack. In this situation an attacker connects to a PPP dialup port on a
Linux based system and issues the switch from console to ppp then sends
data at precisely the right moment afterwards so that data arrives
during the line discipline switch.

This original locking issue was discovered following up real world
customer crashes on very highly loaded large port servers. Attempting to
duplicate it intentionally has been successful over a raw serial link
but not over a modem. The modems add sufficient randomisation that you
cannot easily hit the very narrow window. As such it appears that the
remote attack is not in fact dangerous.

Jason Baron has also made 2.4.x patches available and posted them to
linux-kernel. No 2.2 patches currently exist.

Alan