CVE-2021-47282

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: bcm2835: Fix out-of-bounds access with more than 4 slaves

Commit 571e31fa60b3 ("spi: bcm2835: Cache CS register value for

->prepare_message()") limited the number of slaves to 3 at compile-time.

The limitation was necessitated by a statically-sized array prepare_cs[]

in the driver private data which contains a per-slave register value.

The commit sought to enforce the limitation at run-time by setting the

controller's num_chipselect to 3: Slaves with a higher chipselect are

rejected by spi_add_device().

However the commit neglected that num_chipselect only limits the number

of *native* chipselects. If GPIO chipselects are specified in the

device tree for more than 3 slaves, num_chipselect is silently raised by

of_spi_get_gpio_numbers() and the result are out-of-bounds accesses to

the statically-sized array prepare_cs[].

As a bandaid fix which is backportable to stable, raise the number of

allowed slaves to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References