In the Linux kernel, the following vulnerability has been resolved:
serial: mxs-auart: add spinlock around changing cts state
The uarthandlectschange() function in serialcore expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-0f669324", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc0637e6b16158af85945425821bfd0151adb37" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-16e25a4e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54c4ec5f8c471b7c1137a1f769648549c423c026" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-2c39e0db", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b0e65c75f4af888ab2dd6c90f060f762924e86" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-2fc3383f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c9b943e9924cf1269e44289bc5e60e51b0f5270" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-3755c4cb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c9b943e9924cf1269e44289bc5e60e51b0f5270" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-46f8eb0f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@479244d68f5d94f3903eced52b093c1e01ddb495" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-4bfed623", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56434e295bd446142025913bfdf1587f5e1970ad" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-5d9122ff", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b0e65c75f4af888ab2dd6c90f060f762924e86" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-66f4ee45", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f40fd6ca2cf0bfbc5a5c9e403dfce8ca899ba37" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-714b7a0d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc0637e6b16158af85945425821bfd0151adb37" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-7cc90310", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21535ef0ac1945080198fe3e4347ea498205c99a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-aa29a5b5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54c4ec5f8c471b7c1137a1f769648549c423c026" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-c107e853", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@479244d68f5d94f3903eced52b093c1e01ddb495" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-cde78beb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56434e295bd446142025913bfdf1587f5e1970ad" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/tty/serial/mxs-auart.c", "function": "mxs_auart_irq_handle" }, "signature_version": "v1", "digest": { "length": 1015.0, "function_hash": "141152121926796192571271560280916930860" }, "id": "CVE-2024-27000-e05cea95", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21535ef0ac1945080198fe3e4347ea498205c99a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/tty/serial/mxs-auart.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "159149099980199393795980873050375160337", "78091855453449460217679037049869400268", "24947223806506941218780595840063457001", "204038524798809852540904196394818191709", "127033209939750640297551337922124041867", "91072290198533344562125382925339584181", "67082615042417213782920966293069840511", "294155328146007081004117683381512363911", "261895169282035116967213661932488614270", "78516390272944042061879546359429113144" ], "threshold": 0.9 }, "id": "CVE-2024-27000-fd6bf5d8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f40fd6ca2cf0bfbc5a5c9e403dfce8ca899ba37" } ] }