Denial of service in Linux kernel serial driver

1) Improper locking

EUVDB-ID: #VU89243

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52456

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error within the imx_uart_stop_tx() function in drivers/tty/serial/imx.c. A local user can crash the OS kernel.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: before 5.10.209

External links

http://git.kernel.org/stable/c/6e04a9d30509fb53ba6df5d655ed61d607a7cfda
http://git.kernel.org/stable/c/ff168d4fdb0e1ba35fb413a749b3d6cce918ec19
http://git.kernel.org/stable/c/63ee7be01a3f7d28b1ea8b8d7944f12bb7b0ed06
http://git.kernel.org/stable/c/763cd68746317b5d746dc2649a3295c1efb41181
http://git.kernel.org/stable/c/9a662d06c22ddfa371958c2071dc350436be802b
http://git.kernel.org/stable/c/78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.