CVE-2024-26998

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26998
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 Patch
https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 Patch
https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 Patch
https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 Patch
https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 Patch
https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
History

23 Dec 2024, 19:50

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-476
References () https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 - () https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 - Patch
References () https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 - () https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 - Patch
References () https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 - () https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 - () https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350 -
References () https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 - () https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940 -
References () https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 - () https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985 -

13 May 2024, 08:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

03 May 2024, 03:16

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: core: borrando el búfer circular antes de anularlo. El búfer circular se anula en uart_tty_port_shutdown() bajo el bloqueo de giro. Sin embargo, el PM u otras devoluciones de llamada basadas en temporizadores aún pueden activarse después de este evento sin saber que el puntero del búfer no es válido. Dado que el código de serie es un poco inconsistente al verificar el estado del búfer (algunos se basan en las posiciones de cabecera y cola, otros en el puntero del búfer), es mejor tener ambos alineados, es decir, que el puntero del búfer sea NULL y las posiciones de cabecera y cola sean lo mismo, lo que significa que está vacío. Esto evitará llamadas asincrónicas para desreferenciar el puntero NULL como se informó recientemente en el caso 8250: ERROR: desreferencia del puntero NULL del kernel, dirección: 00000cf5 Cola de trabajo: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809). . serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend ( incluir/linux/serial_core.h:667 controladores/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393)? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) El cambio propuesto evitará que se llame a ->start_tx() durante la suspensión al cerrar el puerto.

01 May 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 06:15

Updated : 2024-12-23 19:50

NVD link : CVE-2024-26998

Mitre link : CVE-2024-26998

CVE.ORG link : CVE-2024-26998

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference