CVE-2024-43893

What it actually does

Improper validation of baud_base input via TIOCSSERIAL ioctl allows uartclk to be set to zero, causing a divide-by-zero fault in uart_get_divisor during subsequent termios changes and leading to kernel oops.

Why it matters to the business

Local users can trigger kernel crashes on systems exposing serial ports, resulting in denial of service, loss of terminal access, and potential system instability in embedded, server, or Android environments using the affected kernel.

How an attack unfolds

An attacker with local access invokes the TIOCSSERIAL ioctl on a serial port with an invalid baud_base value to zero uartclk; later termios or startup operations then call uart_get_divisor and divide by zero, crashing the kernel. The flaw was referenced in broader 2024 kernel exploitation campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to a version containing commit 3bbd90fca824e6fd61fb20f6dd2b0fa5f8b14bba or later stable releases; Android kernels should incorporate the equivalent fix dated 2022-10-05 or newer. Reboot after applying the update.

How to confirm the fix worked

Confirm kernel source contains the uartclk zero check before other settings in uart_set_info; attempt the TIOCSSERIAL ioctl with invalid baud_base on a test system and verify no divide-by-zero oops occurs; check running kernel version against the fixed commit.

Typical attack path

1. Obtain local user access on a Linux system with serial ports
2. Open a serial device and issue TIOCSSERIAL ioctl with crafted baud_base that sets uartclk to zero
3. Trigger follow-on operations such as termios changes or port startup that invoke uart_get_divisor
4. Cause divide-by-zero fault and kernel oops leading to denial of service

How to detect it

Search kernel logs and crash dumps for oops messages referencing uart_get_divisor, serial8250_get_divisor, or divide error during TIOCSSERIAL handling; correlate with tty_ioctl call traces and monitor for repeated serial port configuration attempts from untrusted processes.

• uart_get_divisor
• divide error: 0000
• serial8250_get_divisor
• uart_set_info
• TIOCSSERIAL

What your security team should do

• Prioritize kernel updates to the fixed commit across all Linux and Android deployments that expose serial devices
• Restrict unprivileged access to TIOCSSERIAL ioctls via LSM or seccomp where serial ports are not required
• Monitor for kernel oops reports involving uart_get_divisor and schedule patching before the next maintenance window
• Audit custom kernels or downstream distributions for the missing check and backport the fix