CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set
In the Linux kernel, the following vulnerability has been resolved:
serial: sc16is7xx: fix invalid FIFO access with special register set
When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading.
Call graph example: sc16is7xxstartup(): entry sc16is7xxmsproc(): entry sc16is7xxsettermios(): entry sc16is7xxsetbaud(): DLH/DLL = $009C --> access special register set sc16is7xxportirq() entry --> IIR is 0x0C sc16is7xxhandlerx() entry sc16is7xxfiforead(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCRCONFMODEA) sc16is7xxsetbaud(): exit --> Restore access to general register set
Fix the problem by claiming the efrlock mutex when accessing the Special register set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Fix invalid FIFO access when the IRQ handler may read while the device is in Special register set mode. Specifically, when enabling access to the special register set (e.g., DLH/DLL access path indicated by DLH/DLL = $009C), claim the efr_lock mutex around Special register set accesses so the IRQ handler does not incorrectly read the FIFO via RHR at address 0x00 while that address is mapped to DLL (LCR=LCR_CONF_MODE_A).
Linux kernel serial driver: sc16is7xx Special register set access synchronization (efr_lock mutex) = Claim efr_lock mutex before accessing the Special register set; release it after completing access
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44950?
CVE-2024-44950 is classified as a medium severity vulnerability in the Linux Kernel.
How do I fix CVE-2024-44950?
To fix CVE-2024-44950, update the Linux kernel to a version that resolves this vulnerability, such as 6.1.123-1 or 6.12.11-1.
Which versions of the Linux Kernel are affected by CVE-2024-44950?
CVE-2024-44950 affects Linux Kernel versions from 3.16 up to 6.10.5, as well as 6.11-rc1 and 6.11-rc2.
What type of vulnerability is CVE-2024-44950?
CVE-2024-44950 involves an invalid FIFO access issue when enabling access to a special register set in the Linux Kernel.
What can happen if CVE-2024-44950 is exploited?
Exploitation of CVE-2024-44950 can lead to Receiver time-out and RHR interrupts occurring improperly in the Linux Kernel.