CVE-2024-27000: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27000 affects the Linux kernel's serial driver (mxs-auart). The vulnerability was discovered when a race condition was identified in the uart_handle_cts_change() function in serial_core, which expects the caller to hold uport->lock. This issue was first reported when a kernel warning occurred while loading the Bluetooth driver on an i.MX28 board (Kernel Git).

The vulnerability stems from a missing spinlock around the CTS (Clear To Send) state change in the mxs-auart serial driver. The issue manifests when the uart_handle_cts_change() function is called without holding the required uport->lock, leading to potential race conditions. The problem was confirmed through a kernel warning message that occurred at drivers/tty/serial/serial_core.c:3453 (Kernel Git).

The vulnerability could lead to race conditions in the kernel's serial driver implementation, potentially causing system instability or denial of service conditions when using serial communication, particularly in scenarios involving Bluetooth connectivity on affected hardware (NVD).

The vulnerability requires local access and can be triggered when using Bluetooth functionality on affected systems, particularly those using the mxs-auart serial driver. The issue has been observed in real-world scenarios, specifically on i.MX28 boards (Kernel Git).

The issue has been fixed in various Linux kernel versions through the addition of proper spinlock protection. The fix involves adding uart_port_lock() and uart_port_unlock() calls around the critical section in the mxs_auart_irq_handle function. Updates are available for multiple Linux distributions, including Ubuntu 24.04 LTS (kernel 6.8.0-38.38) and Ubuntu 22.04 LTS (kernel 5.15.0-116.126) (Ubuntu Security).