CVE-2024-42248: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-42248 affects the Linux kernel's TTY serial driver for ma35d1. The vulnerability was discovered when it was found that pdev->dev.of_node could be NULL if the "serial" node is absent, potentially leading to issues in the ma35d1 serial driver. The affected versions include Linux kernel versions from 6.5 up to (excluding) 6.6.41 and versions from 6.7 up to (excluding) 6.9.10 (NVD).

The vulnerability exists in the ma35d1_serial.c driver where there was a missing NULL check for the of_node pointer. The issue was assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD). The technical fix involved adding a NULL check to return an error (-ENODEV) when pdev->dev.of_node is NULL (Kernel Patch).

The vulnerability could allow a local attacker to cause a denial of service condition in the system. The impact is limited to availability with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that adds a NULL check for of_node. Ubuntu has released updates for affected versions including 24.04 LTS (noble) and 22.04 LTS (jammy) with specific kernel versions. Users should update their systems to the patched versions (Ubuntu).