CVE-2023-52567

What it actually does

Null pointer dereference in serial8250_handle_irq when the 8250 UART is configured for IRQ polling (irq=0) and the IIR register indicates a pending interrupt, causing a kernel oops on timer-driven paths.

Why it matters to the business

Systems relying on legacy serial console or polling-mode UARTs can experience sudden kernel crashes, resulting in loss of serial access, service disruption, and potential data loss on affected Linux hosts.

How an attack unfolds

An attacker with local access configures a serial port for polling mode, triggers hardware interrupt conditions visible in the IIR register, and forces the timer path to dereference a NULL IRQ data pointer, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.14.327 or later, or apply commit ee5732caaffba3a37e753fdb89b4958db9a61847 from the stable tree. Rebuild and reboot with the patched kernel; test serial console functionality after upgrade.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release, confirm the patch is present in the source tree, and exercise serial ports under polling mode while monitoring for NULL pointer oops in dmesg.

Typical attack path

1. Obtain local user or process execution on the target host
2. Configure serial port (ttyS) with irq=0 polling via driver parameters or userspace tools
3. Generate conditions that set the IIR interrupt-pending bit while the timer routine runs
4. Trigger serial8250_handle_irq from the timeout handler to hit the NULL dereference

How to detect it

Search kernel logs for 'BUG: kernel NULL pointer dereference' combined with 'serial8250_handle_irq' and 'serial8250_timeout'; inspect dmesg and syslog for 8250 UART initialization lines showing irq=0 immediately preceding crashes.

What your security team should do

• Prioritize kernel upgrades on any hosts exposing serial consoles or using 8250 UART polling
• Audit kernel boot parameters and driver configurations for irq=0 usage
• Schedule staged rollouts and regression testing of serial functionality post-patch
• Monitor vendor advisories for backports into distribution kernels