CVE-2024-44951

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Both sides of the race are driven purely from local userspace — `write(2)` on one `/dev/ttySC*` node queues `tx_work` into the chip kworker while `read(2)`/incoming traffic on the sibling channel runs the threaded-IRQ RX handler. No network path exists, but no physical access is needed either, since the corrupting write and the observable leak both occur through tty device nodes.

AC:LAttack complexity, low

The unprotected window spans an entire SPI/I²C bus transfer of up to 64 bytes, and the attacker can keep one channel transmitting continuously to re-arm the race indefinitely at no cost. The upstream report confirms the corruption occurs spontaneously under normal dual-channel traffic, so no condition beyond the attacker's control is required.

PR:LPrivileges required, low

The attacker needs only open/read/write access to one of the chip's tty nodes, which on the embedded, industrial and automotive systems using SC16IS75x/76x bridges is granted to ordinary users via the dialout group or service accounts. No CAP_SYS_ADMIN or root is required anywhere on the path.

UI:NUser interaction, none

The race is triggered by the attacker's own writes racing against ambient traffic on the sibling channel; no victim action is needed. The victim process is affected simply by using its own serial port normally.

S:UScope, unchanged

The vulnerable driver and all impacted resources (the tty ports it manages) are within the same kernel security authority. No VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

The race copies one channel's data into the other's stream in both directions — channel A's received bytes are emitted on channel B's physical wire, and channel B's transmit payload appears in channel A's tty read buffer where a different, lower-privileged user can read it. Because the attacker can sustain the race by flooding its own channel, a large fraction of the victim channel's traffic (console output, credentials, modem/AT sequences, metering or control data) can be harvested over time.

I:HIntegrity impact, high

Attacker-supplied bytes written to one tty are injected into the other channel's receive stream and are consumed by the victim as legitimate serial input — including passing through `uart_handle_sysrq_char()` on a console channel — while the victim's intended TX payload is silently replaced with foreign data on the wire. This is unauthenticated modification of another security context's data stream and of the commands actually delivered to attached hardware.

A:HAvailability impact, high

Data taken from `xmit_fifo` by `uart_fifo_out()` is destroyed when overwritten, so the victim channel's traffic is permanently lost, and the attacker can sustain this by keeping its own channel busy. For the RS-485 control buses, modem links and serial consoles these bridge chips serve, continuous corruption renders the link unusable — a total loss of that communication resource.