Linux Kernel 8250_dw Serial Port Unregistration Clock Notifier Failure Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's 8250_dw serial driver. This issue arises during the port registration process, specifically within the dw8250_probe() function. When the function attempts to register a clock notifier and the registration fails, it returns an error but does not unregister the previously registered 8250 port. As a result, the port slot remains occupied until the device is rebound or the system is rebooted. Furthermore, the driver data allocated with devm is freed while the port still references it through saved callbacks, creating a use-after-free hazard. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability leads to a use-after-free condition, where a freed memory area is still referenced, potentially allowing for arbitrary memory access or manipulation.

Reproduction

To reproduce this vulnerability, load a device with a clock into the 8250_dw driver. The driver will register the serial port and then attempt to register a clock notifier. If the clock notifier registration fails, the driver will not unregister the serial port, leaving the port slot occupied. The issue can be observed by accessing the port slot before the device is rebound, which will trigger the use-after-free hazard.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.