CVE-2023-52608

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Check mailbox/SMT channel for consistency

On reception of a completion interrupt the shared memory area is accessed

to retrieve the message header at first and then, if the message sequence

number identifies a transaction which is still pending, the related

payload is fetched too.

When an SCMI command times out the channel ownership remains with the

platform until eventually a late reply is received and, as a consequence,

any further transmission attempt remains pending, waiting for the channel

to be relinquished by the platform.

Once that late reply is received the channel ownership is given back

to the agent and any pending request is then allowed to proceed and

overwrite the SMT area of the just delivered late reply; then the wait

for the reply to the new request starts.

It has been observed that the spurious IRQ related to the late reply can

be wrongly associated with the freshly enqueued r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References