CVE-2024-27000
serial: mxs-auart: add spinlock around changing cts state
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
serial: mxs-auart: add spinlock around changing cts state
The uart_handle_cts_change() function in serial_core expects the caller
to hold uport->lock. For example, I have seen the below kernel splat,
when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: mxs-auart: agrega spinlock para cambiar el estado de cts. La función uart_handle_cts_change() en serial_core espera que la persona que llama mantenga uport->lock. Por ejemplo, he visto el siguiente símbolo del kernel, cuando el controlador Bluetooth está cargado en una placa i.MX28. [85.119255] ------------[ cortar aquí ]------------ [ 85.124413] ADVERTENCIA: CPU: 0 PID: 27 en /drivers/tty/serial/ serial_core.c:3453 uart_handle_cts_change+0xb4/0xec [85.134694] Módulos vinculados en: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs [85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 No contaminado 6.6.3-00021-gd6 2a2f068f92 #1 [85.151396] Nombre de hardware: Freescale MXS (árbol de dispositivos) [85.156679] Cola de trabajo: hci0 hci_power_on [bluetooth] (...) [85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4 [ 85.198787] q_handle de __handle_irq_event_percpu+0x88/0x210 (.. .)
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-19 CVE Reserved
- 2024-05-01 CVE Published
- 2024-05-03 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/4d90bb147ef6b91f529a21b498ff2b5fdc6785b4 | Vuln. Introduced | |
| https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 4.19.313 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 4.19.313" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 5.4.275 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 5.4.275" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 5.10.216 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 5.10.216" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 5.15.158 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 5.15.158" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 6.1.88 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 6.1.88" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 6.6.29 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 6.6.29" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 6.8.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 6.8.8" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 6.9" | en |
Affected
| ||||||