Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-26998— serial: core: Clearing the circular buffer before NULLifying it

AI Predicted 6.5 Difficulty: Moderate EPSS 0.23% · P14

Possible ATT&CK Techniques 1AI

T1059.014

Affected Version Matrix 11

VendorProductVersion RangeStatus
LinuxLinux434beb66368d4fb4d3119c2116b9398500adbf47< 7ae7104d54342433a3a73975f6569beefdd86350affected
43066e32227ecde674e8ae1fcdd4a1ede67680c2< bb1118905e875c111d7ccef9aee86ac5e4e7f985affected
43066e32227ecde674e8ae1fcdd4a1ede67680c2< 9cf7ea2eeb745213dc2a04103e426b960e807940affected
a629a9b2f7699314a4abe8fbc37b0ee667b60f33affected
6.6.24< 6.6.29affected
6.7.12< 6.8affected
6.8affected
< 6.8unaffected
… +3 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-26998

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
serial: core: Clearing the circular buffer before NULLifying it
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于循环缓冲区存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 434beb66368d4fb4d3119c2116b9398500adbf47 ~ 7ae7104d54342433a3a73975f6569beefdd86350 -
LinuxLinux 6.8 -

II. Public POCs for CVE-2024-26998

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-26998

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-26998 (3)

Other References for CVE-2024-26998 (3)

Same Patch Batch · Linux · 2024-05-01 · 159 CVEs total

CVE-2024-273889.8 CRITICALSUNRPC: fix some memleaks in gssx_dec_option_array
CVE-2024-269539.8 CRITICALnet: esp: fix bad handling of pages from page_pool
CVE-2024-269318.8 HIGHscsi: qla2xxx: Fix command flush on cable pull
CVE-2024-270538.8 HIGHwifi: wilc1000: fix RCU usage in connect path
CVE-2024-269908.8 HIGHKVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
CVE-2024-269528.3 HIGHksmbd: fix potencial out-of-bounds when buffer offset is invalid
CVE-2024-270188.2 HIGHnetfilter: br_netfilter: skip conntrack input hook for promisc packets
CVE-2024-269368.2 HIGHksmbd: validate request buffer size in smb2_allocate_rsp_buf()
CVE-2024-269808.2 HIGHksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
CVE-2024-269548.1 HIGHksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
CVE-2024-269947.8 HIGHspeakup: Avoid crash on very long word
CVE-2024-269667.8 HIGHclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
CVE-2024-269747.8 HIGHcrypto: qat - resolve race condition during AER recovery
CVE-2024-269767.8 HIGHKVM: Always flush async #PF workqueue when vCPU is being destroyed
CVE-2024-270627.8 HIGHnouveau: lock the client object tree.
CVE-2024-270617.8 HIGHcrypto: sun8i-ce - Fix use after free in unprepare
CVE-2024-269837.8 HIGHbootconfig: use memblock_free_late to free xbc memory to buddy
CVE-2024-270587.8 HIGHtmpfs: fix race on handling dquot rbtree
CVE-2024-270567.8 HIGHwifi: iwlwifi: mvm: ensure offloading TID queue exists
CVE-2024-270177.8 HIGHnetfilter: nft_set_pipapo: walk over current view on netlink dump

Showing top 20 of 159 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-26998

No comments yet

Leave a comment