CVE-2022-50625

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

serial: amba-pl011: avoid SBSA UART accessing DMACR register

Chapter "B Generic UART" in "ARM Server Base System Architecture" [1]

documentation describes a generic UART interface. Such generic UART

does not support DMA. In current code, sbsa_uart_pops and

amba_pl011_pops share the same stop_rx operation, which will invoke

pl011_dma_rx_stop, leading to an access of the DMACR register. This

commit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the

access to DMACR register for SBSA UARTs which does not support DMA.

When the kernel enables DMA engine with "CONFIG_DMA_ENGINE=y", Linux

SBSA PL011 driver will access PL011 DMACR register in some functions.

For most real SBSA Pl011 hardware implementations, the DMACR write

behaviour will be ignored. So these DMACR operations will not cause

obvious problems. But for some virtual SBSA PL011 hardware, like Xen

virtual SBSA PL011 (vpl011) device, the behaviour might be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References