CVE-2024-35994

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: Fix memory related IO errors and crashes

It turns out that while the QSEECOM APP_SEND command has specific fields

for request and response buffers, uefisecapp expects them both to be in

a single memory region. Failure to adhere to this has (so far) resulted

in either no response being written to the response buffer (causing an

EIO to be emitted down the line), the SCM call to fail with EINVAL

(i.e., directly from TZ/firmware), or the device to be hard-reset.

While this issue can be triggered deterministically, in the current form

it seems to happen rather sporadically (which is why it has gone

unnoticed during earlier testing). This is likely due to the two

kzalloc() calls (for request and response) being directly after each

other. Which means that those likely return consecutive regions most of

the time, especially when not much else is going on in the system.

Fix this by allocating a s

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References