{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44950", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.665Z", "datePublished": "2024-09-04T18:35:50.602Z", "dateUpdated": "2026-08-05T11:37:15.955Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:15.955Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix invalid FIFO access with special register set\n\nWhen enabling access to the special register set, Receiver time-out and\nRHR interrupts can happen. In this case, the IRQ handler will try to read\nfrom the FIFO thru the RHR register at address 0x00, but address 0x00 is\nmapped to DLL register, resulting in erroneous FIFO reading.\n\nCall graph example:\n sc16is7xx_startup(): entry\n sc16is7xx_ms_proc(): entry\n sc16is7xx_set_termios(): entry\n sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set\n sc16is7xx_port_irq() entry --> IIR is 0x0C\n sc16is7xx_handle_rx() entry\n sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is\n mapped to DLL (LCR=LCR_CONF_MODE_A)\n sc16is7xx_set_baud(): exit --> Restore access to general register set\n\nFix the problem by claiming the efr_lock mutex when accessing the Special\nregister set." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable window is opened by `sc16is7xx_set_termios()`→`sc16is7xx_set_baud()`, reached from a local `TCSETS`/`tcsetattr` ioctl or `open()` on `/dev/ttySC*`, and the racing interrupt side (THRI, and RX via `TIOCM_LOOP`) is also generated locally. No network or physical access to the serial line is required.\nAC:L - The attacker controls both sides of the race — looping `tcsetattr` while writing to the port generates THRI/RX interrupts on demand — and the window spans several SPI/I2C register transactions (tens of microseconds), so it is hit reliably; the commit message documents it occurring during ordinary port startup.\nPR:L - Requires only an unprivileged account with access to the tty device node (dialout group, or the common embedded/IoT case where the SC16IS7xx port is user-accessible); no root or capability is needed.\nUI:N - The attacking process performs the termios changes and the port I/O itself; no victim action is required.\nS:U - The corruption is confined to the kernel's own serial driver state and the UART bridge it manages, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:N - `rxlen` is clamped to `sizeof(one->buf)` before `regmap_noinc_read()`, so there is no out-of-bounds or uninitialized-memory read; the bytes wrongly returned are the DLL baud-divisor register the attacker set itself, disclosing no kernel or other-user data.\nI:H - Attacker-chosen bytes (the DLL divisor value) are injected into the RX stream delivered to whichever process reads the port, and concurrent THR/IER writes land in DLL/DLH, corrupting the baud divisor and permanently desynchronizing regmap's register cache from the hardware — a serious integrity failure on links carrying control traffic (RS-485/Modbus field buses, consoles, modems).\nA:H - The lost IER write leaves THRI enabled in hardware while the cache believes it is cleared, so subsequent `regmap_update_bits()` calls are elided and `sc16is7xx_irq()`'s `do {} while (keep_polling)` loop never terminates — a hung threaded IRQ handler, a saturated shared SPI/I2C bus, and a permanently unusable serial port." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/tty/serial/sc16is7xx.c" ], "versions": [ { "version": "dfeae619d781dee61666d5551b93ba3be755a86b", "lessThan": "cc6a3f35bc9b3a8da1b195420a2e8d9fdadfa831", "status": "affected", "versionType": "git" }, { "version": "dfeae619d781dee61666d5551b93ba3be755a86b", "lessThan": "dc5ead0e8fc5ef53b8553394d4aab60c277976b3", "status": "affected", "versionType": "git" }, { "version": "dfeae619d781dee61666d5551b93ba3be755a86b", "lessThan": "6a6730812220a9a5ce4003eb347da1ee5abd06b0", "status": "affected", "versionType": "git" }, { "version": "dfeae619d781dee61666d5551b93ba3be755a86b", "lessThan": "7d3b793faaab1305994ce568b59d61927235f57b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/tty/serial/sc16is7xx.c" ], "versions": [ { "version": "3.16", "status": "affected" }, { "version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.10.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cc6a3f35bc9b3a8da1b195420a2e8d9fdadfa831" }, { "url": "https://git.kernel.org/stable/c/dc5ead0e8fc5ef53b8553394d4aab60c277976b3" }, { "url": "https://git.kernel.org/stable/c/6a6730812220a9a5ce4003eb347da1ee5abd06b0" }, { "url": "https://git.kernel.org/stable/c/7d3b793faaab1305994ce568b59d61927235f57b" } ], "title": "serial: sc16is7xx: fix invalid FIFO access with special register set", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-44950", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:40:23.237971Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:37.131Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:39:00.788Z" } } ] } }