In the Linux kernel, the following vulnerability has been resolved:
serial: mxs-auart: add spinlock around changing cts state
The uarthandlectschange() function in serialcore expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc0637e6b16158af85945425821bfd0151adb37",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-0f669324"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54c4ec5f8c471b7c1137a1f769648549c423c026",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-16e25a4e"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b0e65c75f4af888ab2dd6c90f060f762924e86",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-2c39e0db"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c9b943e9924cf1269e44289bc5e60e51b0f5270",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-2fc3383f"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c9b943e9924cf1269e44289bc5e60e51b0f5270",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-3755c4cb"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@479244d68f5d94f3903eced52b093c1e01ddb495",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-46f8eb0f"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56434e295bd446142025913bfdf1587f5e1970ad",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-4bfed623"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b0e65c75f4af888ab2dd6c90f060f762924e86",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-5d9122ff"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f40fd6ca2cf0bfbc5a5c9e403dfce8ca899ba37",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-66f4ee45"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc0637e6b16158af85945425821bfd0151adb37",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-714b7a0d"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54c4ec5f8c471b7c1137a1f769648549c423c026",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-aa29a5b5"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c",
"function": "mxs_auart_irq_handle"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@479244d68f5d94f3903eced52b093c1e01ddb495",
"digest": {
"length": 1015.0,
"function_hash": "141152121926796192571271560280916930860"
},
"id": "CVE-2024-27000-c107e853"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56434e295bd446142025913bfdf1587f5e1970ad",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-cde78beb"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/tty/serial/mxs-auart.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f40fd6ca2cf0bfbc5a5c9e403dfce8ca899ba37",
"digest": {
"line_hashes": [
"159149099980199393795980873050375160337",
"78091855453449460217679037049869400268",
"24947223806506941218780595840063457001",
"204038524798809852540904196394818191709",
"127033209939750640297551337922124041867",
"91072290198533344562125382925339584181",
"67082615042417213782920966293069840511",
"294155328146007081004117683381512363911",
"261895169282035116967213661932488614270",
"78516390272944042061879546359429113144"
],
"threshold": 0.9
},
"id": "CVE-2024-27000-fd6bf5d8"
}
]