CVE-2024-35977: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35977 is a race condition vulnerability in the Linux kernel's Chrome hardware platform drivers, specifically in the cros_ec_uart component. The vulnerability was discovered in May 2024 and affects Linux kernel versions from 6.3 up to (excluding) 6.6.28, and versions from 6.7 up to (excluding) 6.8.7, as well as release candidates 6.9-rc1 through 6.9-rc3 (NVD).

The vulnerability stems from a race condition in the cros_ec_uart_probe() function, which calls devm_serdev_device_open() before serdev_device_set_client_ops(). This incorrect sequence can trigger a NULL pointer dereference when SERPORT_ACTIVE is set and serdev exists, but serdev->ops hasn't been initialized yet. The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (Medium) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

When exploited, this vulnerability can cause a kernel NULL pointer dereference, leading to a denial of service condition. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability requires local access with low privileges and high attack complexity to exploit. A previous attempt to fix a similar race condition (commit 01f95d42b8f4) actually made the window of error for this race condition wider (Kernel Patch).

The vulnerability has been fixed in Linux kernel versions 6.6.28, 6.8.7, and later releases. The fix ensures proper setup sequence by moving the devm_serdev_device_open() call after serdev_device_set_client_ops(), preventing the race condition (Kernel Patch).