CVE-2020-15437: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-15437 is a vulnerability discovered in the Linux kernel versions before 5.8, specifically affecting the UART 8250 functionality. The vulnerability involves a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() function, where the p->serial_in pointer remains uninitialized under certain conditions (CVE Mitre, Debian Tracker).

The vulnerability occurs in the serial port driver of the Linux kernel where the SERIAL_PORT_DFNS is not defined on certain architectures. When this definition is missing, the serial8250_set_defaults() function is not called in serial8250_isa_init_ports(), resulting in an uninitialized p->serial_in pointer. This leads to a NULL pointer dereference when the pointer is accessed (LKML Patch).

When exploited, this vulnerability can allow local users to cause a denial of service condition by triggering a system crash through the uninitialized pointer access. The vulnerability has been assigned a CVSS 3 Severity Score of 4.4 (Medium) (Ubuntu Security).

The vulnerability requires local access to the system and can be triggered by unprivileged users. The exploitation involves accessing the uninitialized p->serial_in pointer through the serial port driver interface (Red Hat Portal).

The issue has been fixed in Linux kernel version 5.8 and backported to various distribution kernels. The fix involves calling serial8250_set_defaults() after initializing the UART port. Multiple Linux distributions have released patches, including Ubuntu (versions 20.04 LTS, 18.04 LTS, and 16.04 LTS) and Debian (bullseye, bookworm, and trixie) (Ubuntu Security, Debian Tracker).