Linux: Improper Locking
CVE-2024-44951 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 263682f5669ceeb70b14b4eda209fb34d67331ec, 2a0ba376cdf729b5c66226c65c6c7cf9de744d52, 09cfe05e9907f3276887a20e267cc40e202f4fdd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 263682f5669ceeb70b14b4eda209fb34d67331ec or 2a0ba376cdf729b5c66226c65c6c7cf9de744d52 or 09cfe05e9907f3276887a20e267cc40e202f4fdd or 133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.2 or 6.7 or 6.8 or 6.10.5, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 4b068e55bf5ea7bab4d8a282c6a24b03e80c0b68 up to, but not including, 263682f5669ceeb70b14b4eda209fb34d67331ec; 9879e1bec3c0f077427dd0d258c80c63ce9babdf up to, but not including, 2a0ba376cdf729b5c66226c65c6c7cf9de744d52; 4409df5866b7ff7686ba27e449ca97a92ee063c9 up to, but not including, 09cfe05e9907f3276887a20e267cc40e202f4fdd; 4409df5866b7ff7686ba27e449ca97a92ee063c9 up to, but not including, 133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4; dbe196ca489f3833e0f9eeb86ac346194f131c91; 6.1.76 up to, but not including, 6.1.191; 6.6.15 up to, but not including, 6.6.160; 6.7.3 up to, but not including, 6.8; and 1 more ranges | 263682f5669ceeb70b14b4eda209fb34d67331ec, 2a0ba376cdf729b5c66226c65c6c7cf9de744d52, 09cfe05e9907f3276887a20e267cc40e202f4fdd, 133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4, 6.1.191, 6.6.160 |
| Linux | Linux Kernel | 6.1.76 up to, but not including, 6.2; 6.6.15 up to, but not including, 6.7; 6.7.3 up to, but not including, 6.8; 6.8 up to, but not including, 6.10.5; 6.11 | 6.2, 6.7, 6.8, 6.10.5 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the received packet on channel A is transmitted on channel B. In other words, the Tx buffer data on channel B is corrupted with data from channel A. The problem appeared since commit 4409df5866b7 ("serial: sc16is7xx: change EFR lock to operate on each channels"), which changed the EFR locking to operate on each channel instead of chip-wise. This commit has introduced a regression, because the EFR lock is used not only to protect the EFR registers access, but also, in a very obscure and undocumented way, to protect access to the data buffer, which is shared by the Tx and Rx handlers, but also by each channel of the IC. Fix this regression first by switching to kfifo_out_linear_ptr() in sc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer. Secondly, replace the chip-wise Rx buffer with a separate Rx buffer for each channel.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Improper Locking vulnerabilities
- 7.8 High severity
- 7.1 High severity
- 7.5 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.