CVE-2021-47346

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

commit 6f755e85c332 ("coresight: Add helper for inserting synchronization

packets") removed trailing '\0' from barrier_pkt array and updated the

call sites like etb_update_buffer() to have proper checks for barrier_pkt

size before read but missed updating tmc_update_etf_buffer() which still

reads barrier_pkt past the array size resulting in KASAN out-of-bounds

bug. Fix this by adding a check for barrier_pkt size before accessing

like it is done in etb_update_buffer().

BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698

Read of size 4 at addr ffffffd05b7d1030 by task perf/2629

Call trace:

dump_backtrace+0x0/0x27c

show_stack+0x20/0x2c

dump_stack+0x11c/0x188

print_address_description+0x3c/0x4a4

__kasan_report+0x140/0x164

kasan_report+0x10/0x18

__asan_report_load4_noabort+0x1c/0x24

tmc_update_etf_buffer+0x4b8/0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References