CVE-2024-26807: linux-libc-dev - Kernel SPI Cadence-qspi Pointer Reference Vulnerability
Summary
CVE-2024-26807: In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_co... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used for developing applications that interact with the kernel. The vulnerability affects the spi: cadence-qspi module in the kernel. This module is responsible for managing the Cadence Quad SPI controller. The vulnerability arises from a pointer reference issue in the runtime power management (PM) hooks of the spi: cadence-qspi module. This issue can lead to memory corruption and potential security risks.
Vulnerability Detail
The vulnerability in the spi: cadence-qspi module is caused by the misuse of the dev_get_drvdata() function, which is used to acquire the pointer to cqspi and the SPI controller. However, neither of these structures embeds the other, resulting in memory corruption. On the Mobileye EyeQ5 platform, the memory corruption is hidden inside cqspi->f_pdata. Additionally, this uninitialized memory is used as a mutex (ctlr->bus_lock_mutex) by spi_controller_suspend(). The vulnerability can be exploited to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
The vulnerability in the spi: cadence-qspi module of the linux-libc-dev package can lead to memory corruption and potential security risks. It is recommended to update the package to version 6.1.90-1 or later to fix the vulnerability. Rebuilding and reinstalling dependent applications is necessary after the update. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used for developing applications that interact with the kernel.
The spi: cadence-qspi module is responsible for managing the Cadence Quad SPI controller in the kernel. It allows communication with SPI devices connected to the system.
dev_get_drvdata() is a function in the Linux kernel that retrieves the driver-specific data associated with a device. In this case, it is used to acquire the pointer to cqspi and the SPI controller.
The vulnerability can lead to memory corruption, which can be exploited to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.
To fix this vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later. Rebuild and reinstall any applications that depend on the linux-libc-dev package after the update.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
