of/irq: Prevent device address out-of-bounds read in interrupt map walk
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1
CVE-2024-46743
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-46743
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "d2a79494d8a5262949736fb2c3ac44d20a51b0d8",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "defcaa426ba0bc89ffdafb799d2e50b52f74ffc4",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "baaf26723beab3a04da578d3008be3544f83758f",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "8ff351ea12e918db1373b915c4c268815929cbe5",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "7ead730af11ee7da107f16fc77995613c58d292d",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "bf68acd840b6a5bfd3777e0d5aaa204db6b461a9",
"versionType": "git"
},
{
"status": "affected",
"version": "cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08",
"lessThan": "b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305",
"versionType": "git"
}
],
"programFiles": [
"drivers/of/irq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.322",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.284",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.226",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.167",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.110",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.51",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.10",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/of/irq.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-46743
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26712 · Revision 1
- Added to Heist Feed
- Publisher date