CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set
In the Linux kernel, the following vulnerability has been resolved:
serial: sc16is7xx: fix invalid FIFO access with special register set
When enabling access to the special register set, Receiver time-out and
RHR interrupts can happen. In this case, the IRQ handler will try to read
from the FIFO thru the RHR register at address 0x00, but address 0x00 is
mapped to DLL register, resulting in erroneous FIFO reading.
Call graph example:
sc16is7xx_startup(): entry
sc16is7xx_ms_proc(): entry
sc16is7xx_set_termios(): entry
sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set
sc16is7xx_port_irq() entry --> IIR is 0x0C
sc16is7xx_handle_rx() entry
sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is
mapped to DLL (LCR=LCR_CONF_MODE_A)
sc16is7xx_set_baud(): exit --> Restore access to general register set
Fix the problem by claiming the efr_lock mutex when accessing the Special
register set.
Security readout for executives and security teams
Plain-English summary
A locking flaw in Linux’s SC16IS7xx serial driver can make the kernel read the wrong hardware register when an interrupt overlaps a baud-rate change. This may corrupt serial data or disrupt availability. Risk is limited to systems using this driver and associated hardware; it is not described as remotely exploitable.
Executive priority
Treat this as a high-priority maintenance issue for appliances or hosts using SC16IS7xx hardware, especially where serial-data integrity or uptime is operationally important. Broader fleets without this driver have lower urgency. No active exploitation evidence is supplied, so prioritize targeted identification and supported kernel updates rather than emergency fleet-wide action.
Technical view
While the driver exposes its special register set, receive-related interrupts can invoke the FIFO reader. Register address 0x00 then maps to DLL instead of the receive holding register, producing an invalid FIFO read. The kernel fix serializes special-register access with the efr_lock mutex. CVSS 3.1 is 7.1: local, low complexity, low privileges, no user interaction, with high integrity and availability impact.
Likely exposure
Potentially exposed systems run an affected Linux kernel and actively use the SC16IS7xx serial driver. The supplied version data does not clearly encode complete affected ranges, although it identifies several stable fix points and commits. Confirm the exact patched kernel or distributor backport rather than relying only on version strings.
Exploitation context
The supplied evidence describes a locally reachable concurrency flaw requiring low privileges. It provides no evidence of public exploitation, and the CVE is not listed as KEV in the bundle. Trigger conditions involve receive interrupts occurring while the driver accesses special registers; practical reliability and impact are not documented.
Researcher notes
The defect is a register-window synchronization race between baud configuration and interrupt-driven receive handling. The supplied records identify four stable-tree commits, but affected-version representation is ambiguous and no CWE is assigned. Validate branch-specific ancestry or distributor backports. The sources do not establish exploit reliability, observed attacks, or impacts beyond erroneous FIFO access and the CVSS integrity/availability assessment.
Mitigation direction
Install a supported vendor kernel containing the efr_lock fix or an equivalent backport.
Verify the applicable stable fix commit against the deployed kernel branch.
Consult the Linux distributor’s advisory when package version mappings are unclear.
Prioritize systems that actively use SC16IS7xx serial hardware.
Validation and detection
Inventory kernel versions and determine whether the SC16IS7xx driver is present and used.
Check vendor package changelogs or source for the corresponding stable fix.
Confirm special-register access is protected by efr_lock in the deployed source or backport.
After updating, run normal serial-device functional and regression testing.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-44950 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.