firmware: qcom: uefisecapp: Fix memory related IO errors and crashes (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.19 % · centile 9 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It turns out that while the QSEECOM APP_SEND command has specific fields for request and response buffers, uefisecapp expects them both to be in a single memory region. Failure to adhere to this has (so far) resulted in either no response being written to the response buffer (causing an EIO to be emitted down the line), the SCM call to fail with EINVAL (i.e., directly from TZ/firmware), or the device to be hard-reset. While this issue can be triggered deterministically, in the current form it seems to happen rather sporadically (which is why it has gone unnoticed during earlier testing). This is likely due to the two kzalloc() calls (for request and response) being directly after each other. Which means that those likely return consecutive regions most of the time, especially when not much else is going on in the system. Fix this by allocating a single memory region for both request and response buffers, properly aligning both structs inside it. This unfortunately also means that the qcom_scm_qseecom_app_send() interface needs to be restructured, as it should no longer map the DMA regions separately. Therefore, move the responsibility of DMA allocation (or mapping) to the caller.
Faiblesses (CWE)
- CWE-401 — Mémoire non libérée après sa durée de vie utile
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-35712
- GCVE · GCVE-0-2024-35994
Avis du CERT-FR
- CERTFR-2024-AVI-0694 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0667 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.8.9cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9 < dd22b34fb53cb04b13b2f5eee5c9200bb091fc88 ; affected 759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9 < ed09f81eeaa8f9265e1787282cb283f10285c259 |
| Linux · Linux | affected 6.7 ; unaffected 0 < 6.7 ; unaffected 6.8.9 ≤ 6.8.* ; unaffected 6.9 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |