CVE-2023-54220

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Fix oops for port->pm on uart_change_pm()

Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm().

Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm().

A low-impact kernel oops in the Linux kernel 8250 serial driver affects Red Hat Enterprise Linux 9 (kernel and kernel-rt). If a hardware-specific 8250 driver has initialized the port->pm callback and that driver is unloaded or unbound, the callback pointer is not cleared; when the port is later shut down through uart_hangup() calling uart_change_pm(), serial8250_pm() invokes the stale port->pm() callback instead of serial8250_do_pm(), roughly ten seconds after the unload, producing a kernel paging request oops. Triggering this requires local access with the privileges needed to unload or unbind a kernel driver, and the consequence is limited to availability (a kernel oops that takes down the system); there is no impact on confidentiality or integrity. For this reason Red Hat rates this flaw Low severity (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), which differs materially from the CVE.org score of 7.8 (Important) that assumes high confidentiality, integrity, and availability impact. RHEL 6, 7, 8, and 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those streams. On the affected RHEL 9 streams the fix is currently deferred given the low severity of the issue; the residual risk while the fix is deferred is limited to a local denial of service that occurs only when a hardware-specific 8250 serial driver is unloaded or unbound.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a workaround, avoid unloading or unbinding hardware-specific 8250 serial drivers on affected systems. The kernel oops is triggered only after such a driver has been unloaded, when uart_hangup() invokes the stale port->pm callback through uart_change_pm(), so keeping the driver loaded prevents the issue. Beyond this workaround and applying a future update that contains the fix, no other mitigation is currently available.