Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-26999— serial/pmac_zilog: Remove flawed mitigation for rx irq flood

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于调用pmz_receive_chars()中的pr_err()导致函数 pmz_console_write()试图锁定已锁定的自旋锁 pmz_interrupt()。

AI Predicted 5.3 Difficulty: Trivial EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 69a02273e288011b521ee7c1f3ab2c23fda633ce affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d679c816929d62af51c8e6d7fc0e165c9412d2f3 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ab86cf6f8d24e63e9aca23da5108af1aa5483928 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 7a3bbe41efa55323b6ea3c35fa15941d4dbecdef affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< bbaafbb4651fede8d3c3881601ecaa4f834f9d3f affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 52aaf1ff14622a04148dbb9ccce6d9de5d534ea7 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ca09dfc3cfdf89e6af3ac24e1c6c0be5c575a729 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 1be3226445362bfbf461c92a5bcdb1723f2e4907 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-26999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG: spinlock recursion on CPU#0, swapper/0 That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port. Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below. A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于调用pmz_receive_chars()中的pr_err()导致函数 pmz_console_write()试图锁定已锁定的自旋锁 pmz_interrupt()。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 69a02273e288011b521ee7c1f3ab2c23fda633ce -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2024-26999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-26999

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-26999 (1)

Other References for CVE-2024-26999 (8)

Same Patch Batch · Linux · 2024-05-01 · 159 CVEs total

CVE-2024-27388 9.8 CRITICAL SUNRPC: fix some memleaks in gssx_dec_option_array
CVE-2024-26953 9.8 CRITICAL net: esp: fix bad handling of pages from page_pool
CVE-2024-26931 8.8 HIGH scsi: qla2xxx: Fix command flush on cable pull
CVE-2024-27053 8.8 HIGH wifi: wilc1000: fix RCU usage in connect path
CVE-2024-26990 8.8 HIGH KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
CVE-2024-26952 8.3 HIGH ksmbd: fix potencial out-of-bounds when buffer offset is invalid
CVE-2024-27018 8.2 HIGH netfilter: br_netfilter: skip conntrack input hook for promisc packets
CVE-2024-26936 8.2 HIGH ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
CVE-2024-26980 8.2 HIGH ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
CVE-2024-26954 8.1 HIGH ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
CVE-2024-26994 7.8 HIGH speakup: Avoid crash on very long word
CVE-2024-26966 7.8 HIGH clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
CVE-2024-26974 7.8 HIGH crypto: qat - resolve race condition during AER recovery
CVE-2024-26976 7.8 HIGH KVM: Always flush async #PF workqueue when vCPU is being destroyed
CVE-2024-27062 7.8 HIGH nouveau: lock the client object tree.
CVE-2024-27061 7.8 HIGH crypto: sun8i-ce - Fix use after free in unprepare
CVE-2024-26983 7.8 HIGH bootconfig: use memblock_free_late to free xbc memory to buddy
CVE-2024-27058 7.8 HIGH tmpfs: fix race on handling dquot rbtree
CVE-2024-27056 7.8 HIGH wifi: iwlwifi: mvm: ensure offloading TID queue exists
CVE-2024-27017 7.8 HIGH netfilter: nft_set_pipapo: walk over current view on netlink dump

Showing top 20 of 159 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-26999

No comments yet

Leave a comment