cve-2024-26998
Vulnerability from cvelistv5
Published
2024-05-01 05:28
Modified
2024-08-02 00:21
Severity
Summary
serial: core: Clearing the circular buffer before NULLifying it
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T18:39:13.227309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:46.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ae7104d5434",
              "status": "affected",
              "version": "434beb66368d",
              "versionType": "git"
            },
            {
              "lessThan": "bb1118905e87",
              "status": "affected",
              "version": "43066e32227e",
              "versionType": "git"
            },
            {
              "lessThan": "9cf7ea2eeb74",
              "status": "affected",
              "version": "43066e32227e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: Clearing the circular buffer before NULLifying it\n\nThe circular buffer is NULLified in uart_tty_port_shutdown()\nunder the spin lock. However, the PM or other timer based callbacks\nmay still trigger after this event without knowning that buffer pointer\nis not valid. Since the serial code is a bit inconsistent in checking\nthe buffer state (some rely on the head-tail positions, some on the\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\nThis will prevent asynchronous calls to dereference NULL pointer as\nreported recently in 8250 case:\n\n  BUG: kernel NULL pointer dereference, address: 00000cf5\n  Workqueue: pm pm_runtime_work\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  ...\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\n  __rpm_callback (drivers/base/power/runtime.c:393)\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\n  rpm_suspend (drivers/base/power/runtime.c:447)\n\nThe proposed change will prevent -\u003estart_tx() to be called during\nsuspend on shut down port."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:26:41.917Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
        }
      ],
      "title": "serial: core: Clearing the circular buffer before NULLifying it",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26998",
    "datePublished": "2024-05-01T05:28:25.905Z",
    "dateReserved": "2024-02-19T14:20:24.206Z",
    "dateUpdated": "2024-08-02T00:21:05.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26998\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:17.780\",\"lastModified\":\"2024-05-13T08:15:11.390\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: core: borrando el b\u00fafer circular antes de anularlo. El b\u00fafer circular se anula en uart_tty_port_shutdown() bajo el bloqueo de giro. Sin embargo, el PM u otras devoluciones de llamada basadas en temporizadores a\u00fan pueden activarse despu\u00e9s de este evento sin saber que el puntero del b\u00fafer no es v\u00e1lido. Dado que el c\u00f3digo de serie es un poco inconsistente al verificar el estado del b\u00fafer (algunos se basan en las posiciones de cabecera y cola, otros en el puntero del b\u00fafer), es mejor tener ambos alineados, es decir, que el puntero del b\u00fafer sea NULL y las posiciones de cabecera y cola sean lo mismo, lo que significa que est\u00e1 vac\u00edo. Esto evitar\u00e1 llamadas asincr\u00f3nicas para desreferenciar el puntero NULL como se inform\u00f3 recientemente en el caso 8250: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 00000cf5 Cola de trabajo: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809). . serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend ( incluir/linux/serial_core.h:667 controladores/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393)? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) El cambio propuesto evitar\u00e1 que se llame a -\u0026gt;start_tx() durante la suspensi\u00f3n al cerrar el puerto.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.