Linux Kernel Parport Subsystem Race Condition Vulnerability

A race condition vulnerability has been identified in the Linux kernel's parport subsystem. This issue arises because port devices are registered before they are fully initialized, allowing client drivers, such as 'lp', to attach to ports that are not completely ready or are in the process of being torn down. This vulnerability can lead to system crashes, particularly when the port and client drivers are loaded as modules around the same time during boot. The problem was consistently reproduced in a virtual machine with a PC-style parallel port by patching the 'parport_pc' driver to simulate a probing failure. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability can cause system crashes by creating a race condition between the initialization of port devices and the attachment of client drivers.

Reproduction

The vulnerability can be reproduced by loading the 'lp' and 'parport_pc' modules simultaneously, after patching 'parport_pc' to fail its probing. This can be done by modifying the 'parport_pc' driver to return a null response during the probing process, effectively simulating a failure. Once this modification is in place, 'lp' and 'parport_pc' can be loaded at the same time, which will trigger the race condition. After a few seconds, 'lp' can be removed, which may lead to a crash, demonstrating the vulnerability.

Remediation

The vulnerability has been addressed by modifying the parport subsystem to ensure that ports are fully initialized before client drivers can attach. This fix involves adding a flag to indicate whether a port has been announced and only allowing client drivers to connect when this flag is set. Users should update to the latest version of the Linux kernel where this vulnerability has been fixed.