Bug 2320612 (CVE-2024-50058) - CVE-2024-50058 kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too
Summary: CVE-2024-50058 kernel: serial: protect uart_port_dtr_rts() in uart_shutdown()...
Keywords:
Status: NEW
Alias: CVE-2024-50058
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2320907
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-21 20:03 UTC by OSIDB Bzimport
Modified: 2025-05-13 08:31 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:6966 0 None None None 2025-05-13 08:31:13 UTC

Description OSIDB Bzimport 2024-10-21 20:03:23 UTC
In the Linux kernel, the following vulnerability has been resolved:

serial: protect uart_port_dtr_rts() in uart_shutdown() too

Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part
3) added few uport == NULL checks. It added one to uart_shutdown(), so
the commit assumes, uport can be NULL in there. But right after that
protection, there is an unprotected "uart_port_dtr_rts(uport, false);"
call. That is invoked only if HUPCL is set, so I assume that is the
reason why we do not see lots of these reports.

Or it cannot be NULL at this point at all for some reason :P.

Until the above is investigated, stay on the safe side and move this
dereference to the if too.

I got this inconsistency from Coverity under CID 1585130. Thanks.

Comment 1 Avinash Hanwate 2024-10-22 10:33:33 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102135-CVE-2024-50058-e827@gregkh/T

Comment 2 errata-xmlrpc 2025-05-13 08:31:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966


Note You need to log in before you can comment on or make changes to this bug.