Linux Kernel Platform Device Usage Vulnerability in DECstation DZ Serial Driver

A vulnerability has been identified in the Linux kernel's handling of the DECstation DZ serial driver. The issue arises from the driver using legacy probing methods, which can lead to a null pointer dereference and a kernel crash when the first serial port is initialized. This problem occurs because no device is available with the old probing method, and the driver fails to properly manage the serial controller resources. The vulnerability affects the Linux kernel versions prior to the latest stable release, specifically in the DECstation DZ serial driver.

Impact

Exploitation of this vulnerability causes a kernel panic due to a null pointer dereference, disrupting system operations and potentially leading to a denial of service.

Reproduction

The vulnerability can be reproduced by loading the DECstation DZ serial driver on a supported MIPS architecture system. The driver will attempt to initialize the serial ports using legacy probing, which does not properly set up the necessary device resources. As a result, when the driver tries to access the parent device of the serial port, it encounters a null pointer, leading to a kernel paging request error and a crash.

Remediation

The vulnerability has been addressed by updating the DECstation DZ serial driver to use platform devices instead of legacy probing methods. This change allows for proper resource management and prevents the null pointer dereference. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this issue.