CVE-2024-43893: serial: core: check uartclk for zero to avoid divide by zero
In the Linux kernel, the following vulnerability has been resolved:
serial: core: check uartclk for zero to avoid divide by zero
Calling ioctl TIOCSSERIAL with an invalid baudbase can result in uartclk being zero, which will result in a divide by zero error in uartgetdivisor(). The check for uartclk being zero in uartsetinfo() needs to be done before other settings are made as subsequent calls to ioctl TIOCSSERIAL for the same port would be impacted if the uartclk check was done where uartclk gets set.
Oops: divide error: 0000 PREEMPT SMP KASAN PTI RIP: 0010:uartgetdivisor (drivers/tty/serial/serialcore.c:580) Call Trace: <TASK> serial8250getdivisor (drivers/tty/serial/8250/8250port.c:2576 drivers/tty/serial/8250/8250port.c:2589) serial8250dosettermios (drivers/tty/serial/8250/8250port.c:502 drivers/tty/serial/8250/8250port.c:2741) serial8250settermios (drivers/tty/serial/8250/8250port.c:2862) uartchangelinesettings (./include/linux/spinlock.h:376 ./include/linux/serialcore.h:608 drivers/tty/serial/serialcore.c:222) uartportstartup (drivers/tty/serial/serialcore.c:342) uartstartup (drivers/tty/serial/serialcore.c:368) uartsetinfo (drivers/tty/serial/serialcore.c:1034) uartsetinfouser (drivers/tty/serial/serialcore.c:1059) ttysetserial (drivers/tty/ttyio.c:2637) ttyioctl (drivers/tty/ttyio.c:2647 drivers/tty/ttyio.c:2791) x64sysioctl (fs/ioctl.c:52 fs/ioctl.c:907 fs/ioctl.c:893 fs/ioctl.c:893) dosyscall64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130)
Rule: add
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43893?
CVE-2024-43893 has been classified with a medium severity due to the potential for a divide-by-zero error.
How do I fix CVE-2024-43893?
To fix CVE-2024-43893, you should upgrade your Linux kernel to one of the following versions: 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-43893?
CVE-2024-43893 affects various versions of the Linux kernel, particularly those prior to 5.10.224, 6.1.119-1~deb11u1, and other specific versions outlined in the vulnerability description.
What is the potential impact of CVE-2024-43893?
The potential impact of CVE-2024-43893 includes system instability due to divide-by-zero errors when an invalid baud base is set.
Is there a workaround for CVE-2024-43893 if I cannot update immediately?
Currently, the best practice is to avoid using TIOCSSERIAL with invalid baud_base values until you can apply the recommended kernel updates.