LiveActive security incident?Get immediate response
CVE Record

CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set

In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set.

HighCVSS 7.1Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A locking flaw in Linux’s SC16IS7xx serial driver can make the kernel read the wrong hardware register when an interrupt overlaps a baud-rate change. This may corrupt serial data or disrupt availability. Risk is limited to systems using this driver and associated hardware; it is not described as remotely exploitable.

Executive priority

Treat this as a high-priority maintenance issue for appliances or hosts using SC16IS7xx hardware, especially where serial-data integrity or uptime is operationally important. Broader fleets without this driver have lower urgency. No active exploitation evidence is supplied, so prioritize targeted identification and supported kernel updates rather than emergency fleet-wide action.

Technical view

While the driver exposes its special register set, receive-related interrupts can invoke the FIFO reader. Register address 0x00 then maps to DLL instead of the receive holding register, producing an invalid FIFO read. The kernel fix serializes special-register access with the efr_lock mutex. CVSS 3.1 is 7.1: local, low complexity, low privileges, no user interaction, with high integrity and availability impact.

Likely exposure

Potentially exposed systems run an affected Linux kernel and actively use the SC16IS7xx serial driver. The supplied version data does not clearly encode complete affected ranges, although it identifies several stable fix points and commits. Confirm the exact patched kernel or distributor backport rather than relying only on version strings.

Exploitation context

The supplied evidence describes a locally reachable concurrency flaw requiring low privileges. It provides no evidence of public exploitation, and the CVE is not listed as KEV in the bundle. Trigger conditions involve receive interrupts occurring while the driver accesses special registers; practical reliability and impact are not documented.

Researcher notes

The defect is a register-window synchronization race between baud configuration and interrupt-driven receive handling. The supplied records identify four stable-tree commits, but affected-version representation is ambiguous and no CWE is assigned. Validate branch-specific ancestry or distributor backports. The sources do not establish exploit reliability, observed attacks, or impacts beyond erroneous FIFO access and the CVSS integrity/availability assessment.

Mitigation direction

  • Install a supported vendor kernel containing the efr_lock fix or an equivalent backport.
  • Verify the applicable stable fix commit against the deployed kernel branch.
  • Consult the Linux distributor’s advisory when package version mappings are unclear.
  • Prioritize systems that actively use SC16IS7xx serial hardware.

Validation and detection

  • Inventory kernel versions and determine whether the SC16IS7xx driver is present and used.
  • Check vendor package changelogs or source for the corresponding stable fix.
  • Confirm special-register access is protected by efr_lock in the deployed source or backport.
  • After updating, run normal serial-device functional and regression testing.
Prepared
Confidence
high
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-44950 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2024-44950Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86bunaffected
LinuxLinux3.16, 0, 6.1.120, 6.6.64, 6.10.5, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.