| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-43893: serial: core: check uartclk for zero to avoid divide by zero |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| serial: core: check uartclk for zero to avoid divide by zero |
| |
| Calling ioctl TIOCSSERIAL with an invalid baud_base can |
| result in uartclk being zero, which will result in a |
| divide by zero error in uart_get_divisor(). The check for |
| uartclk being zero in uart_set_info() needs to be done |
| before other settings are made as subsequent calls to |
| ioctl TIOCSSERIAL for the same port would be impacted if |
| the uartclk check was done where uartclk gets set. |
| |
| Oops: divide error: 0000 PREEMPT SMP KASAN PTI |
| RIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580) |
| Call Trace: |
| <TASK> |
| serial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576 |
| drivers/tty/serial/8250/8250_port.c:2589) |
| serial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502 |
| drivers/tty/serial/8250/8250_port.c:2741) |
| serial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862) |
| uart_change_line_settings (./include/linux/spinlock.h:376 |
| ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222) |
| uart_port_startup (drivers/tty/serial/serial_core.c:342) |
| uart_startup (drivers/tty/serial/serial_core.c:368) |
| uart_set_info (drivers/tty/serial/serial_core.c:1034) |
| uart_set_info_user (drivers/tty/serial/serial_core.c:1059) |
| tty_set_serial (drivers/tty/tty_io.c:2637) |
| tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791) |
| __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907 |
| fs/ioctl.c:893 fs/ioctl.c:893) |
| do_syscall_64 (arch/x86/entry/common.c:52 |
| (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) |
| entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) |
| |
| Rule: add |
| |
| The Linux kernel CVE team has assigned CVE-2024-43893 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.19.320 with commit 3bbd90fca824e6fd61fb20f6dd2b0fa5f8b14bba |
| Fixed in 5.4.282 with commit 55b2a5d331a6ceb1c4372945fdb77181265ba24f |
| Fixed in 5.10.224 with commit 52b138f1021113e593ee6ad258ce08fe90693a9e |
| Fixed in 5.15.165 with commit 9196e42a3b8eeff1707e6ef769112b4b6096be49 |
| Fixed in 6.1.105 with commit e13ba3fe5ee070f8a9dab60029d52b1f61da5051 |
| Fixed in 6.6.46 with commit e3ad503876283ac3fcca922a1bf243ef9eb0b0e2 |
| Fixed in 6.10.5 with commit 68dc02f319b9ee54dc23caba742a5c754d1cccc8 |
| Fixed in 6.11 with commit 6eabce6608d6f3440f4c03aa3d3ef50a47a3d193 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-43893 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/tty/serial/serial_core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/3bbd90fca824e6fd61fb20f6dd2b0fa5f8b14bba |
| https://git.kernel.org/stable/c/55b2a5d331a6ceb1c4372945fdb77181265ba24f |
| https://git.kernel.org/stable/c/52b138f1021113e593ee6ad258ce08fe90693a9e |
| https://git.kernel.org/stable/c/9196e42a3b8eeff1707e6ef769112b4b6096be49 |
| https://git.kernel.org/stable/c/e13ba3fe5ee070f8a9dab60029d52b1f61da5051 |
| https://git.kernel.org/stable/c/e3ad503876283ac3fcca922a1bf243ef9eb0b0e2 |
| https://git.kernel.org/stable/c/68dc02f319b9ee54dc23caba742a5c754d1cccc8 |
| https://git.kernel.org/stable/c/6eabce6608d6f3440f4c03aa3d3ef50a47a3d193 |
