PT-2023-9476 · Linux+4 · Linux Kernel+4
Tobias Schramm
·
Published
2023-09-04
·
Updated
2026-03-14
·
CVE-2023-52517
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a race condition between DMA RX transfer completion and RX FIFO drain in the Linux kernel's spi: sun6i component. This behaviour is correct when dealing with SPI in interrupt mode, but in DMA mode, the transfer complete interrupt still fires as soon as all bytes to be transferred have been stored in the FIFO. At that point, data in the FIFO still needs to be picked up by the DMA engine, thus the drain procedure and DMA engine end up racing to read from RX FIFO, corrupting any data read. The RX buffer pointer is never adjusted according to DMA progress in DMA mode, making the RX FIFO drain procedure a bug in this mode. The fix involves draining RX FIFO only in interrupt mode and waiting for completion of RX DMA when in DMA mode before returning to ensure all data has been copied to the supplied memory buffer.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linux Kernel
Red Os
Suse