CVE-2024-36965

The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well.

Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic.

To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core).

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

00548ac6b14428719c970ef90adae2b3b48c0cdf

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

1d9e2de24533daca36cbf09e8d8596bf72b526b2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

26c6d7dc8c6a9fde9d362ab2eef6390efeff145e

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

838b49e211d59fa827ff9df062d4020917cffbdf

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

36c79eb4845551e9f6d28c663b38ce0ab03b84a9

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3efa0ea743b77d1611501f7d8b4f320d032d73ae

Fixed

331f91d86f71d0bb89a44217cc0b2a22810bbd42

Affected versions

v5.*

v5.10

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.132

v5.15.133

v5.15.134

v5.15.135

v5.15.136

v5.15.137

v5.15.138

v5.15.139

v5.15.14

v5.15.140

v5.15.141

v5.15.142

v5.15.143

v5.15.144

v5.15.145

v5.15.146

v5.15.147

v5.15.148

v5.15.149

v5.15.15

v5.15.150

v5.15.151

v5.15.152

v5.15.153

v5.15.154

v5.15.155

v5.15.156

v5.15.157

v5.15.158

v5.15.159

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.59

v6.1.6

v6.1.60

v6.1.61

v6.1.62

v6.1.63

v6.1.64

v6.1.65

v6.1.66

v6.1.67

v6.1.68

v6.1.69

v6.1.7

v6.1.70

v6.1.71

v6.1.72

v6.1.73

v6.1.74

v6.1.75

v6.1.76

v6.1.77

v6.1.78

v6.1.79

v6.1.8

v6.1.80

v6.1.81

v6.1.82

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.9

v6.1.90

v6.1.91

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.4

v6.6.5

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.8.1

v6.8.10

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.8.6

v6.8.7

v6.8.8

v6.8.9

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

v6.9.1

Database specific

vanir_signatures

[
    {
        "id": "CVE-2024-36965-0fcf602f",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26c6d7dc8c6a9fde9d362ab2eef6390efeff145e",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-1a745514",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00548ac6b14428719c970ef90adae2b3b48c0cdf",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-2b2e1eb7",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@331f91d86f71d0bb89a44217cc0b2a22810bbd42",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-3e767b4d",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@838b49e211d59fa827ff9df062d4020917cffbdf",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-603f6e55",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@838b49e211d59fa827ff9df062d4020917cffbdf",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-67aec06f",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26c6d7dc8c6a9fde9d362ab2eef6390efeff145e",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-7580ba2a",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00548ac6b14428719c970ef90adae2b3b48c0cdf",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-938ef10b",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9e2de24533daca36cbf09e8d8596bf72b526b2",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-a22fafd5",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@331f91d86f71d0bb89a44217cc0b2a22810bbd42",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-a75c44ec",
        "digest": {
            "length": 584.0,
            "function_hash": "10089190715325171274835429811858243752"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c",
            "function": "scp_ipi_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c79eb4845551e9f6d28c663b38ce0ab03b84a9",
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-b70d8a4d",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9e2de24533daca36cbf09e8d8596bf72b526b2",
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2024-36965-be00f6e7",
        "digest": {
            "line_hashes": [
                "20455396588377448396418263734820897136",
                "233722928701939960003523978897001851298",
                "223126120710167645849242093740231895993",
                "195199706090935217439747180203234190261",
                "282463055840442580612405075203792783768",
                "223098938701564106616188425313807526776",
                "266787285442103958173504656165056845976"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/remoteproc/mtk_scp.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c79eb4845551e9f6d28c663b38ce0ab03b84a9",
        "signature_type": "Line",
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.160

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.92

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.32

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.8.11

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.9.2