CVE-2024-46743

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

of/irq: Prevent device address out-of-bounds read in interrupt map walk

When of_irq_parse_raw() is invoked with a device address smaller than

the interrupt parent node (from #address-cells property), KASAN detects

the following out-of-bounds read when populating the initial match table

(dyndbg="func of_irq_parse_* +p"):

OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0

OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2

OF: intspec=4

OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2

OF: -> addrsize=3

==================================================================

BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0

Read of size 4 at addr ffffff81beca5608 by task bash/764

CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1

Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References