Jiri Slaby

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved, related to the `uart port dtr rts()` function in `uart shutdown()`. The issue arises from an unprotected call to `uart port dtr rts(uport, false)` after a `uport == NULL` check was added. This call is only invoked if `HUPCL` is set. The vulnerability was identified by Coverity under CID 1585130. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider moving the dereference of `uport` to the `if` statement to prevent potential null pointer dereferences. Restrict access to the `uart port dtr rts()` function until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.11.0+ Description: The issue is related to a use-after-free vulnerability in the `gsm cleanup mux` function in the Linux kernel. This vulnerability can be exploited by an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when `gsm msg` on the `tx ctrl list` or `tx data list` of `gsm mux` can be freed by multiple threads through `ioctl`, leading to a use-after-free condition. The vulnerability can be protected by using the `gsm tx lock`. Recommendations: To resolve the issue, update the Linux kernel to a version that includes the fix for the `gsm cleanup mux` use-after-free vulnerability. As a temporary workaround, consider restricting access to the `ioctl` function to minimize the risk of exploitation. Additionally, ensure that the `gsm tx lock` is properly used to protect against the use-after-free condition.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A issue in the Linux kernel has been identified, specifically in the mxser module. The problem occurs when the Line Status Register (LSR) is 0xff in the `activate()` function, which can lead to an error and a potential buffer leak. Normally, when `activate()` fails, the buffer is not freed because `shutdown()` is not called. This issue is resolved by properly freeing the buffer in a designated label. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions through 3.14.3 **Description** The issue is related to errors in the implementation of access to shared resources in the Linux operating system. It allows for the exploitation of a race condition in the `n tty write` function, which can lead to a denial of service or privilege escalation by triggering a race condition involving read and write operations with long strings. This can result in memory corruption and system crash. **Recommendations** For Linux Kernel versions through 3.14.3, consider applying a patch to fix the `n tty write` function in drivers/tty/n tty.c to properly manage tty driver access in the "LECHO & !OPOST" case. As a temporary workaround, consider restricting access to the tty driver to minimize the risk of exploitation.