CVE-2024-44951

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-44951", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.665Z", "datePublished": "2024-09-04T18:35:51.366Z", "dateUpdated": "2026-10-30T12:19:10.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:19:10.867Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix TX fifo corruption\n\nSometimes, when a packet is received on channel A at almost the same time\nas a packet is about to be transmitted on channel B, we observe with a\nlogic analyzer that the received packet on channel A is transmitted on\nchannel B. In other words, the Tx buffer data on channel B is corrupted\nwith data from channel A.\n\nThe problem appeared since commit 4409df5866b7 (\"serial: sc16is7xx: change\nEFR lock to operate on each channels\"), which changed the EFR locking to\noperate on each channel instead of chip-wise.\n\nThis commit has introduced a regression, because the EFR lock is used not\nonly to protect the EFR registers access, but also, in a very obscure and\nundocumented way, to protect access to the data buffer, which is shared by\nthe Tx and Rx handlers, but also by each channel of the IC.\n\nFix this regression first by switching to kfifo_out_linear_ptr() in\nsc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.\n\nSecondly, replace the chip-wise Rx buffer with a separate Rx buffer for\neach channel."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Both sides of the race are driven purely from local userspace \u2014 `write(2)` on one `/dev/ttySC*` node queues `tx_work` into the chip kworker while `read(2)`/incoming traffic on the sibling channel runs the threaded-IRQ RX handler. No network path exists, but no physical access is needed either, since the corrupting write and the observable leak both occur through tty device nodes.\nAC:L - The unprotected window spans an entire SPI/I\u00b2C bus transfer of up to 64 bytes, and the attacker can keep one channel transmitting continuously to re-arm the race indefinitely at no cost. The upstream report confirms the corruption occurs spontaneously under normal dual-channel traffic, so no condition beyond the attacker's control is required.\nPR:L - The attacker needs only open/read/write access to one of the chip's tty nodes, which on the embedded, industrial and automotive systems using SC16IS75x/76x bridges is granted to ordinary users via the dialout group or service accounts. No CAP_SYS_ADMIN or root is required anywhere on the path.\nUI:N - The race is triggered by the attacker's own writes racing against ambient traffic on the sibling channel; no victim action is needed. The victim process is affected simply by using its own serial port normally.\nS:U - The vulnerable driver and all impacted resources (the tty ports it manages) are within the same kernel security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The race copies one channel's data into the other's stream in both directions \u2014 channel A's received bytes are emitted on channel B's physical wire, and channel B's transmit payload appears in channel A's tty read buffer where a different, lower-privileged user can read it. Because the attacker can sustain the race by flooding its own channel, a large fraction of the victim channel's traffic (console output, credentials, modem/AT sequences, metering or control data) can be harvested over time.\nI:H - Attacker-supplied bytes written to one tty are injected into the other channel's receive stream and are consumed by the victim as legitimate serial input \u2014 including passing through `uart_handle_sysrq_char()` on a console channel \u2014 while the victim's intended TX payload is silently replaced with foreign data on the wire. This is unauthenticated modification of another security context's data stream and of the commands actually delivered to attached hardware.\nA:H - Data taken from `xmit_fifo` by `uart_fifo_out()` is destroyed when overwritten, so the victim channel's traffic is permanently lost, and the attacker can sustain this by keeping its own channel busy. For the RS-485 control buses, modem links and serial consoles these bridge chips serve, continuous corruption renders the link unusable \u2014 a total loss of that communication resource."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "versions": [{"version": "4b068e55bf5ea7bab4d8a282c6a24b03e80c0b68", "lessThan": "263682f5669ceeb70b14b4eda209fb34d67331ec", "status": "affected", "versionType": "git"}, {"version": "9879e1bec3c0f077427dd0d258c80c63ce9babdf", "lessThan": "2a0ba376cdf729b5c66226c65c6c7cf9de744d52", "status": "affected", "versionType": "git"}, {"version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "lessThan": "09cfe05e9907f3276887a20e267cc40e202f4fdd", "status": "affected", "versionType": "git"}, {"version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "lessThan": "133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4", "status": "affected", "versionType": "git"}, {"version": "dbe196ca489f3833e0f9eeb86ac346194f131c91", "status": "affected", "versionType": "git"}, {"version": "6.1.76", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.15", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.7.3", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.76", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.10.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/263682f5669ceeb70b14b4eda209fb34d67331ec"}, {"url": "https://git.kernel.org/stable/c/2a0ba376cdf729b5c66226c65c6c7cf9de744d52"}, {"url": "https://git.kernel.org/stable/c/09cfe05e9907f3276887a20e267cc40e202f4fdd"}, {"url": "https://git.kernel.org/stable/c/133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4"}], "title": "serial: sc16is7xx: fix TX fifo corruption", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-44951", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:40:19.986023Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:36.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-44951", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:40:19.986023Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:27.672Z"}}], "cna": {"title": "serial: sc16is7xx: fix TX fifo corruption", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Both sides of the race are driven purely from local userspace \u2014 `write(2)` on one `/dev/ttySC*` node queues `tx_work` into the chip kworker while `read(2)`/incoming traffic on the sibling channel runs the threaded-IRQ RX handler. No network path exists, but no physical access is needed either, since the corrupting write and the observable leak both occur through tty device nodes.\nAC:L - The unprotected window spans an entire SPI/I\u00b2C bus transfer of up to 64 bytes, and the attacker can keep one channel transmitting continuously to re-arm the race indefinitely at no cost. The upstream report confirms the corruption occurs spontaneously under normal dual-channel traffic, so no condition beyond the attacker's control is required.\nPR:L - The attacker needs only open/read/write access to one of the chip's tty nodes, which on the embedded, industrial and automotive systems using SC16IS75x/76x bridges is granted to ordinary users via the dialout group or service accounts. No CAP_SYS_ADMIN or root is required anywhere on the path.\nUI:N - The race is triggered by the attacker's own writes racing against ambient traffic on the sibling channel; no victim action is needed. The victim process is affected simply by using its own serial port normally.\nS:U - The vulnerable driver and all impacted resources (the tty ports it manages) are within the same kernel security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The race copies one channel's data into the other's stream in both directions \u2014 channel A's received bytes are emitted on channel B's physical wire, and channel B's transmit payload appears in channel A's tty read buffer where a different, lower-privileged user can read it. Because the attacker can sustain the race by flooding its own channel, a large fraction of the victim channel's traffic (console output, credentials, modem/AT sequences, metering or control data) can be harvested over time.\nI:H - Attacker-supplied bytes written to one tty are injected into the other channel's receive stream and are consumed by the victim as legitimate serial input \u2014 including passing through `uart_handle_sysrq_char()` on a console channel \u2014 while the victim's intended TX payload is silently replaced with foreign data on the wire. This is unauthenticated modification of another security context's data stream and of the commands actually delivered to attached hardware.\nA:H - Data taken from `xmit_fifo` by `uart_fifo_out()` is destroyed when overwritten, so the victim channel's traffic is permanently lost, and the attacker can sustain this by keeping its own channel busy. For the RS-485 control buses, modem links and serial consoles these bridge chips serve, continuous corruption renders the link unusable \u2014 a total loss of that communication resource."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4b068e55bf5ea7bab4d8a282c6a24b03e80c0b68", "lessThan": "263682f5669ceeb70b14b4eda209fb34d67331ec", "versionType": "git"}, {"status": "affected", "version": "9879e1bec3c0f077427dd0d258c80c63ce9babdf", "lessThan": "2a0ba376cdf729b5c66226c65c6c7cf9de744d52", "versionType": "git"}, {"status": "affected", "version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "lessThan": "09cfe05e9907f3276887a20e267cc40e202f4fdd", "versionType": "git"}, {"status": "affected", "version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "lessThan": "133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4", "versionType": "git"}, {"status": "affected", "version": "dbe196ca489f3833e0f9eeb86ac346194f131c91", "versionType": "git"}, {"status": "affected", "version": "6.1.76", "lessThan": "6.1.191", "versionType": "semver"}, {"status": "affected", "version": "6.6.15", "lessThan": "6.6.160", "versionType": "semver"}, {"status": "affected", "version": "6.7.3", "lessThan": "6.8", "versionType": "semver"}], "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.5", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/263682f5669ceeb70b14b4eda209fb34d67331ec"}, {"url": "https://git.kernel.org/stable/c/2a0ba376cdf729b5c66226c65c6c7cf9de744d52"}, {"url": "https://git.kernel.org/stable/c/09cfe05e9907f3276887a20e267cc40e202f4fdd"}, {"url": "https://git.kernel.org/stable/c/133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix TX fifo corruption\n\nSometimes, when a packet is received on channel A at almost the same time\nas a packet is about to be transmitted on channel B, we observe with a\nlogic analyzer that the received packet on channel A is transmitted on\nchannel B. In other words, the Tx buffer data on channel B is corrupted\nwith data from channel A.\n\nThe problem appeared since commit 4409df5866b7 (\"serial: sc16is7xx: change\nEFR lock to operate on each channels\"), which changed the EFR locking to\noperate on each channel instead of chip-wise.\n\nThis commit has introduced a regression, because the EFR lock is used not\nonly to protect the EFR registers access, but also, in a very obscure and\nundocumented way, to protect access to the data buffer, which is shared by\nthe Tx and Rx handlers, but also by each channel of the IC.\n\nFix this regression first by switching to kfifo_out_linear_ptr() in\nsc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.\n\nSecondly, replace the chip-wise Rx buffer with a separate Rx buffer for\neach channel."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "6.1.76"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.5", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.7.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:19:10.867Z"}}}, "cveMetadata": {"cveId": "CVE-2024-44951", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:19:10.867Z", "dateReserved": "2024-08-21T05:34:56.665Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-04T18:35:51.366Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "263682f5669ceeb70b14b4eda209fb34d67331ec", "status": "affected", "version": "4b068e55bf5ea7bab4d8a282c6a24b03e80c0b68", "versionType": "git"}, {"lessThan": "2a0ba376cdf729b5c66226c65c6c7cf9de744d52", "status": "affected", "version": "9879e1bec3c0f077427dd0d258c80c63ce9babdf", "versionType": "git"}, {"lessThan": "09cfe05e9907f3276887a20e267cc40e202f4fdd", "status": "affected", "version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "versionType": "git"}, {"lessThan": "133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4", "status": "affected", "version": "4409df5866b7ff7686ba27e449ca97a92ee063c9", "versionType": "git"}, {"status": "affected", "version": "dbe196ca489f3833e0f9eeb86ac346194f131c91", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.76", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.15", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/serial/sc16is7xx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FE19A5C-D7A4-4995-BEE0-2B2E5B46EAC6", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.76", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "61253639-4FB4-4953-A092-ED155EAB1548", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20F5F360-294D-4182-AC38-2F032FA57B3C", "versionEndExcluding": "6.8", "versionStartIncluding": "6.7.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "48E239A0-A959-4FAB-8475-D045FED3DDA5", "versionEndExcluding": "6.10.5", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix TX fifo corruption\n\nSometimes, when a packet is received on channel A at almost the same time\nas a packet is about to be transmitted on channel B, we observe with a\nlogic analyzer that the received packet on channel A is transmitted on\nchannel B. In other words, the Tx buffer data on channel B is corrupted\nwith data from channel A.\n\nThe problem appeared since commit 4409df5866b7 (\"serial: sc16is7xx: change\nEFR lock to operate on each channels\"), which changed the EFR locking to\noperate on each channel instead of chip-wise.\n\nThis commit has introduced a regression, because the EFR lock is used not\nonly to protect the EFR registers access, but also, in a very obscure and\nundocumented way, to protect access to the data buffer, which is shared by\nthe Tx and Rx handlers, but also by each channel of the IC.\n\nFix this regression first by switching to kfifo_out_linear_ptr() in\nsc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.\n\nSecondly, replace the chip-wise Rx buffer with a separate Rx buffer for\neach channel."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: sc16is7xx: fix TX fifo democracy A veces, cuando se recibe un paquete en el canal A casi al mismo tiempo que se va a transmitir un paquete en el canal B, observamos con un analizador l\u00f3gico que el paquete recibido en el canal A se transmite en el canal B. En otras palabras, los datos del b\u00fafer de Tx en el canal B est\u00e1n da\u00f1ados con datos del canal A. El problema apareci\u00f3 desde el commit 4409df5866b7 (\"serial: sc16is7xx: change EFR lock to operate on each channels\"), que cambi\u00f3 el bloqueo de EFR para que funcione en cada canal en lugar de en todo el chip. Este commit ha introducido una regresi\u00f3n, porque el bloqueo de EFR se utiliza no solo para proteger el acceso a los registros de EFR, sino tambi\u00e9n, de una forma muy oscura y no documentada, para proteger el acceso al b\u00fafer de datos, que es compartido por los manejadores de Tx y Rx, pero tambi\u00e9n por cada canal del IC. Primero, solucione esta regresi\u00f3n cambiando a kfifo_out_linear_ptr() en sc16is7xx_handle_tx() para eliminar la necesidad de un b\u00fafer Rx/Tx compartido. En segundo lugar, reemplace el b\u00fafer Rx por chip con un b\u00fafer Rx separado para cada canal."}], "id": "CVE-2024-44951", "lastModified": "2026-10-30T13:17:34.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-44951", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:40:19.986023Z", "version": "2.0.3"}}]}, "published": "2024-09-04T19:15:30.153", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09cfe05e9907f3276887a20e267cc40e202f4fdd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/263682f5669ceeb70b14b4eda209fb34d67331ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a0ba376cdf729b5c66226c65c6c7cf9de744d52"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: serial: sc16is7xx: fix TX fifo corruption", "id": "2309782", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309782"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-667", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nserial: sc16is7xx: fix TX fifo corruption\nSometimes, when a packet is received on channel A at almost the same time\nas a packet is about to be transmitted on channel B, we observe with a\nlogic analyzer that the received packet on channel A is transmitted on\nchannel B. In other words, the Tx buffer data on channel B is corrupted\nwith data from channel A.\nThe problem appeared since commit 4409df5866b7 (\"serial: sc16is7xx: change\nEFR lock to operate on each channels\"), which changed the EFR locking to\noperate on each channel instead of chip-wise.\nThis commit has introduced a regression, because the EFR lock is used not\nonly to protect the EFR registers access, but also, in a very obscure and\nundocumented way, to protect access to the data buffer, which is shared by\nthe Tx and Rx handlers, but also by each channel of the IC.\nFix this regression first by switching to kfifo_out_linear_ptr() in\nsc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.\nSecondly, replace the chip-wise Rx buffer with a separate Rx buffer for\neach channel."], "name": "CVE-2024-44951", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-44951\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-44951\nhttps://lore.kernel.org/linux-cve-announce/2024090411-CVE-2024-44951-9121@gregkh/T"], "threat_severity": "Moderate"}

{}