CVE-2023-53094

A flaw was found in the Linux kernel's Freescale LPUART serial driver. A race condition during receive Direct Memory Access (DMA) shutdown allows an interrupt to restart a timer after DMA resources have been freed. A local user could trigger this condition to cause a null pointer dereference, leading to a system crash and Denial of Service (DoS).

A MODERATE severity race condition flaw was found in the Freescale LPUART serial driver in the Red Hat Enterprise Linux 9 kernel. During serial port shutdown, a receive DMA completion interrupt can run in the middle of lpuart_dma_shutdown() and restart a timer from lpuart_copy_rx_to_tty() after lpuart_dma_rx_free() has already freed the receive DMA resources. When that timer later fires, lpuart_copy_rx_to_tty() dereferences the NULL sport->dma_rx_desc pointer, causing a kernel NULL pointer dereference and a system crash. A local user on a system using this serial driver could trigger this timing-dependent race to cause a denial of service; there is no impact on confidentiality or integrity. The Red Hat Enterprise Linux 9 kernel and kernel-rt streams are affected and the fix is currently deferred, so the residual risk is the local, timing-dependent denial of service described above. Red Hat Enterprise Linux 6, 7, 8, and 10, Red Hat In-Vehicle OS, and the Hosted OpenShift (ARO/OSD) streams are not affected because the vulnerable code is not present in those streams. Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5, availability-only impact), which is lower than the CVE.org score of 7.8 that includes confidentiality and integrity impacts not supported by the technical evidence of a NULL pointer dereference crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.