CVE-2024-26807 spi: cadence-qspi: fix pointer reference in runtime PM hooks
A pointer reference error in the Cadence QSPI driver causes memory corruption and kernel crashes during device probing, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26807?
CVE-2024-26807 is a high-severity memory corruption vulnerability in Linux kernel, published on 4 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with:
struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev);
This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st".
The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore:
struct cqspi_st *cqspi = dev_get_drvdata(dev);
is correct, but:
struct spi_controller *host = dev_get_drvdata(dev);
is not, as it makes "host" point not to a "struct spi_controller" but to the same "struct cqspi_st" structure as above.
This obviously leads to bad things (memory corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->runtime_resume() hook being called, which in turns calls spi_controller_resume() with the wrong pointer.
This has at least been reported [0] to cause a kernel crash, but the exact behavior will depend on the memory contents.
[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/
This issue potentially affects all platforms that are currently using the cadence-quadspi driver.
Weakness: CWE-787
Which versions are affected by CVE-2024-26807?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26807?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-26807 being exploited?
There is no known exploitation of CVE-2024-26807 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26807, DEBIAN-CVE-2024-26807, GHSA-8xc6-54p8-3p65, ROOT-OS-DEBIAN-11-CVE-2024-26807, ROOT-OS-DEBIAN-12-CVE-2024-26807, ROOT-OS-UBUNTU-2204-CVE-2024-26807 and 1 more.