Executive brief
The Linux kernel's TTY (terminal) device driver fails to validate console device indices when processing kernel boot parameters. An attacker or misconfigured system specifying an invalid console device (like console=tty3270) can trigger a null pointer dereference crash, causing a denial of service during system boot.
Technical details
The vulnerability is an out-of-bounds memory access (CWE-125) in the tty_driver_lookup_tty() function in drivers/tty/tty_io.c. The function returns a TTY structure based on a device index without validating that the index is within the valid range of the driver's device array. When an invalid console device is specified via kernel boot parameters, the function may dereference an invalid memory location, triggering a NULL pointer dereference. The fix adds a bounds check: if (idx >= driver->num) return ERR_PTR(-EINVAL) before accessing driver->ttys[idx]. The attack requires local access (kernel boot parameter specification) but can cause immediate denial of service via kernel panic during system initialization.
Affected products
- Linux Linux kernel Affects multiple kernel versions; fix available since 2023-03-11
Timeline
- 2023-03-11: disclosed: Fix committed and merged into stable kernels
- 2025-12-30: advisory: Public disclosure date from advisory