Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2024-38634

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/06/2024
Last modified:
04/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: max3100: Lock port-&gt;lock when calling uart_handle_cts_change()<br /> <br /> uart_handle_cts_change() has to be called with port lock taken,<br /> Since we run it in a separate work, the lock may not be taken at<br /> the time of running. Make sure that it&amp;#39;s taken by explicitly doing<br /> that. Without it we got a splat:<br /> <br /> WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0<br /> ...<br /> Workqueue: max3100-0 max3100_work [max3100]<br /> RIP: 0010:uart_handle_cts_change+0xa6/0xb0<br /> ...<br /> max3100_handlerx+0xc5/0x110 [max3100]<br /> max3100_work+0x12a/0x340 [max3100]

Impact

Vector 3.x
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 5.50 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): None
Availability (A): High

Base Score 3.x
5.50
Severity 3.x
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 2.6.31 (including) 4.19.316 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.278 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.219 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.161 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.93 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.9.4 (excluding)
cpe:2.3:o:linux:linux_kernel:2.6.30:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.30:rc8:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools