CVE-2023-52456
Description
A flaw was found in the UART driver handling RS485 communication in the Linux Kernel when an unexpected closure of the TTY port occurs, such as during a userland application crash. In this scenario, the imx_uart_shutdown function disables the UART interface and the Transmission Complete (TC) interrupt. Subsequently, the imx_uart_stop_tx function attempts to stop the transmission but exits prematurely if the transmission is incomplete, expecting the now-disabled TC interrupt to complete the process. This results in the transmission state machine remaining in a deadlocked SEND state, leaving the TX_EN pin low and rendering the RS485 interface non-functional. This vulnerability can lead to communication failures and potential system instability.
Statement
This vulnerability is considered of Moderate severity because it leads to a deadlock in the transmission state machine, rendering the RS485 interface non-functional and potentially disrupting serial communication. While it does not directly compromise data integrity or security, it can cause significant operational issues, especially in systems relying on continuous and reliable RS485 communication. The impact is limited to the availability of the serial interface rather than the broader system, and it requires a specific condition—an unexpected TTY port closure during transmission—to be triggered.
Mitigation
No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Other); DoS: Crash, Exit, or Restart
Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
