In the Linux kernel, the following vulnerability has been resolved:
serial: 8250: Reinit port->pm on port specific driver unbind
When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs:
Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM
Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone:
serial8250pm [8250base] from uartchangepm+0x54/0x8c [serialbase] uartchangepm [serialbase] from uarthangup+0x154/0x198 [serialbase] uarthangup [serialbase] from _ttyhangup.part.0+0x328/0x37c _ttyhangup.part.0 from disassociatectty+0x154/0x20c disassociatectty from doexit+0x744/0xaac doexit from dogroupexit+0x40/0x8c dogroupexit from _wakeup_parent+0x0/0x1c
Let's fix the issue by calling serial8250setdefaults() in serial8250unregisterport(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53176.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2023-53176-08a6b1b2",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@490bf37eaabb0a857ed1ae8e75d8854e41662f1c",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-0a2aba3d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5cd2928d31042a7c0a01464f9a8d95be736421d",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-1fc1f42f",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04e82793f068d2f0ffe62fcea03d007a8cdc16a7",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-45e7b7d4",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e596aed5f2f98cf3e6e98d6fe1d689f4a319308",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-5722de24",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ba5594739d858e524ff0f398ee1ebfe0a8b9d41",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-5d63fec1",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-65369915",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04e82793f068d2f0ffe62fcea03d007a8cdc16a7",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-69f5f4b9",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e596aed5f2f98cf3e6e98d6fe1d689f4a319308",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-6cc067c2",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ba5594739d858e524ff0f398ee1ebfe0a8b9d41",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-8cd272b9",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e080c3005fd183c56ff8f4d75edb5da0765d2c",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-988edcd5",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5cd2928d31042a7c0a01464f9a8d95be736421d",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-aa378946",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9e080c3005fd183c56ff8f4d75edb5da0765d2c",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-acaef40f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@490bf37eaabb0a857ed1ae8e75d8854e41662f1c",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-b5eba4c5",
"signature_version": "v1",
"digest": {
"function_hash": "214212603743737106387887444989621865948",
"length": 624.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c86a1305c1406f45ea780d06953c484ea1d9e6e",
"signature_type": "Function",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c",
"function": "serial8250_unregister_port"
}
},
{
"id": "CVE-2023-53176-cc47d1dc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c86a1305c1406f45ea780d06953c484ea1d9e6e",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
},
{
"id": "CVE-2023-53176-f12c7fbb",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122707171335221109271375740524833465794",
"28788985211981710996079457266768856014",
"275029852184198740509157025775036717554",
"128254115127190622053120297637499237349"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872",
"signature_type": "Line",
"target": {
"file": "drivers/tty/serial/8250/8250_core.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53176.json"