CVE-2024-38633 serial: max3100: Update uart_driver_registered on driver removal
A null pointer dereference in the Linux kernel MAX3100 serial driver causes a system crash during device removal and re-insertion cycles.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38633?
CVE-2024-38633 is a medium-severity vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
serial: max3100: Update uart_driver_registered on driver removal
The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after insmod — rmmod — insmod cycle the kernel oopses:
max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0
Update the actual state so next time UART driver will be registered again.
Hugo also noticed, that the error path in the probe also affected by having the variable set, and not cleared. Instead of clearing it move the assignment after the successfull uart_register_driver() call.
Weakness: CWE-476
Which versions are affected by CVE-2024-38633?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38633?
Apply the vendor's patch.
Is CVE-2024-38633 being exploited?
There is no known exploitation of CVE-2024-38633 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-38633, DEBIAN-CVE-2024-38633, GHSA-fjgx-ff76-7ggv, UBUNTU-CVE-2024-38633.