cve-2024-26998
Vulnerability from cvelistv5
Published
2024-05-01 05:28
Modified
2024-12-19 08:52
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985
Impacted products
Vendor Product Version
Linux Linux Version: 6.8
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T18:39:13.227309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:46.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ae7104d54342433a3a73975f6569beefdd86350",
              "status": "affected",
              "version": "434beb66368d4fb4d3119c2116b9398500adbf47",
              "versionType": "git"
            },
            {
              "lessThan": "bb1118905e875c111d7ccef9aee86ac5e4e7f985",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            },
            {
              "lessThan": "9cf7ea2eeb745213dc2a04103e426b960e807940",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: Clearing the circular buffer before NULLifying it\n\nThe circular buffer is NULLified in uart_tty_port_shutdown()\nunder the spin lock. However, the PM or other timer based callbacks\nmay still trigger after this event without knowning that buffer pointer\nis not valid. Since the serial code is a bit inconsistent in checking\nthe buffer state (some rely on the head-tail positions, some on the\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\nThis will prevent asynchronous calls to dereference NULL pointer as\nreported recently in 8250 case:\n\n  BUG: kernel NULL pointer dereference, address: 00000cf5\n  Workqueue: pm pm_runtime_work\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  ...\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\n  __rpm_callback (drivers/base/power/runtime.c:393)\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\n  rpm_suspend (drivers/base/power/runtime.c:447)\n\nThe proposed change will prevent -\u003estart_tx() to be called during\nsuspend on shut down port."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:52:12.468Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
        }
      ],
      "title": "serial: core: Clearing the circular buffer before NULLifying it",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26998",
    "datePublished": "2024-05-01T05:28:25.905Z",
    "dateReserved": "2024-02-19T14:20:24.206Z",
    "dateUpdated": "2024-12-19T08:52:12.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26998\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:17.780\",\"lastModified\":\"2024-11-21T09:03:35.200\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: core: borrando el b\u00fafer circular antes de anularlo. El b\u00fafer circular se anula en uart_tty_port_shutdown() bajo el bloqueo de giro. Sin embargo, el PM u otras devoluciones de llamada basadas en temporizadores a\u00fan pueden activarse despu\u00e9s de este evento sin saber que el puntero del b\u00fafer no es v\u00e1lido. Dado que el c\u00f3digo de serie es un poco inconsistente al verificar el estado del b\u00fafer (algunos se basan en las posiciones de cabecera y cola, otros en el puntero del b\u00fafer), es mejor tener ambos alineados, es decir, que el puntero del b\u00fafer sea NULL y las posiciones de cabecera y cola sean lo mismo, lo que significa que est\u00e1 vac\u00edo. Esto evitar\u00e1 llamadas asincr\u00f3nicas para desreferenciar el puntero NULL como se inform\u00f3 recientemente en el caso 8250: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 00000cf5 Cola de trabajo: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809). . serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend ( incluir/linux/serial_core.h:667 controladores/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393)? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) El cambio propuesto evitar\u00e1 que se llame a -\u0026gt;start_tx() durante la suspensi\u00f3n al cerrar el puerto.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.