Out-of-Bounds Access Vulnerability in spi: bcm2835 Package
Summary
GSD-2021-1000891: spi: bcm2835: Fix out-of-bounds access with more than 4 slaves. Affects Kernel versions >= 571e31fa60b3697d5db26140e16d5c45c51c9815, < b5502580cf958b094f3b69dfe4eece90eae01fbc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spi: bcm2835 package is a component of the Linux Kernel ecosystem. It provides support for the SPI (Serial Peripheral Interface) bus on the BCM2835 SoC (System-on-a-Chip) used in Raspberry Pi devices. The SPI bus allows communication between the SoC and external devices, such as sensors, displays, and memory chips. This vulnerability affects the spi: bcm2835 package when more than 4 slaves are connected to the SPI bus.
Vulnerability Detail
The vulnerability in spi: bcm2835 involves an out-of-bounds access issue that occurs when there are more than 4 slaves connected to the SPI bus. This can lead to memory corruption or unintended data access, potentially resulting in system instability or unauthorized access to sensitive information. The vulnerability was introduced in version v5.4 of the Linux Kernel and has been fixed in version v5.4.126 by commit b5502580cf958b094f3b69dfe4eece90eae01fbc.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to a patched version.
Conclusion
The out-of-bounds access vulnerability in spi: bcm2835 can have serious consequences, including memory corruption and unauthorized access to sensitive information. It is crucial to update the Linux Kernel to a patched version, specifically v5.4.126 or later, to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
spi: bcm2835 is a package in the Linux Kernel ecosystem that provides support for the SPI bus on the BCM2835 SoC used in Raspberry Pi devices.
The vulnerability can lead to memory corruption or unintended data access, potentially resulting in system instability or unauthorized access to sensitive information.
To fix this vulnerability, update the Linux Kernel to version v5.4.126 or later.
No, there is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.
For more information, you can refer to the vulnerability details in the Open Source Vulnerability format or consult the official Linux Kernel documentation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
