CVE-2023-52517

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain

Previously the transfer complete IRQ immediately drained to RX FIFO to

read any data remaining in FIFO to the RX buffer. This behaviour is

correct when dealing with SPI in interrupt mode. However in DMA mode the

transfer complete interrupt still fires as soon as all bytes to be

transferred have been stored in the FIFO. At that point data in the FIFO

still needs to be picked up by the DMA engine. Thus the drain procedure

and DMA engine end up racing to read from RX FIFO, corrupting any data

read. Additionally the RX buffer pointer is never adjusted according to

DMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA

mode is a bug.

Fix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode.

Also wait for completion of RX DMA when in DMA mode before returning to

ensure all data has been copied to the supplied memor

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References