Race Condition Vulnerability in Linux Kernel's cros_ec_uart Package
Summary
DEBIAN-CVE-2024-35977: In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_uart: properly fix race condition The cros_ec_uart_probe() function calls devm_serdev_device_open() before it calls serdev_devi... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The cros_ec_uart package is responsible for managing communication between the Chrome OS EC (Embedded Controller) and the host system via UART (Universal Asynchronous Receiver-Transmitter). This package is crucial for ensuring reliable data transmission and device control. However, it is susceptible to a race condition vulnerability that can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a race condition exists in the cros_ec_uart_probe() function, which calls devm_serdev_device_open() before setting the client operations for the serdev device. This sequence can result in a NULL pointer dereference, causing a kernel crash. The issue arises because the code assumes that if SERPORT_ACTIVE is set and the serdev device exists, the operations for that device will also be defined. This assumption is flawed, as the operations are only set after the device is opened, leading to potential crashes when the receive buffer function is called.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The race condition vulnerability in the cros_ec_uart package of the Linux kernel poses significant risks, including system crashes and instability. It is essential to update to the patched version 6.8.9-1 to protect your system. Regular monitoring using tools like Vulert can help ensure your applications remain secure against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
A race condition occurs when the behavior of software depends on the sequence or timing of uncontrollable events, leading to unpredictable results.
This vulnerability can lead to a kernel crash, resulting in system instability and potential data loss.
If you are using an affected version of the Linux kernel prior to 6.8.9-1, your system is vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
