In the Linux kernel, the following vulnerability has been resolved:
of/irq: Prevent device address out-of-bounds read in interrupt map walk
When ofirqparseraw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func ofirqparse* +p"):
OF: ofirqparseone: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: ofirqparseraw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in ofirqparse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764
CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokiasmarm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dumpbacktrace+0xdc/0x130 showstack+0x1c/0x30 dumpstacklvl+0x6c/0x84 printreport+0x150/0x448 kasanreport+0x98/0x140 _asanload4+0x78/0xa0 ofirqparseraw+0x2b8/0x8d0 ofirqparseone+0x24c/0x270 parseinterrupts+0xc0/0x120 offwnodeaddlinks+0x100/0x2d0 fwdevlinkparsefwtree+0x64/0xc0 deviceadd+0xb38/0xc30 ofdeviceadd+0x64/0x90 ofplatformdevicecreatepdata+0xd0/0x170 ofplatformbuscreate+0x244/0x600 ofplatformnotify+0x1b0/0x254 blockingnotifiercallchain+0x9c/0xd0 _ofchangesetentrynotify+0x1b8/0x230 _ofchangesetapplynotify+0x54/0xe4 ofoverlayfdt_apply+0xc04/0xd94 ...
The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680)
The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compoundmapcount:0 compoundpincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it !
Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size.
[
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-0fb51ccd",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@defcaa426ba0bc89ffdafb799d2e50b52f74ffc4",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-26ccfd3a",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a79494d8a5262949736fb2c3ac44d20a51b0d8",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-2aff54ef",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ead730af11ee7da107f16fc77995613c58d292d",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-3d0cbe2b",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@defcaa426ba0bc89ffdafb799d2e50b52f74ffc4",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-4ad4a889",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a79494d8a5262949736fb2c3ac44d20a51b0d8",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-4e707a9d",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ead730af11ee7da107f16fc77995613c58d292d",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-5b70eeed",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baaf26723beab3a04da578d3008be3544f83758f",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-61a51927",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-6a37d349",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baaf26723beab3a04da578d3008be3544f83758f",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-856f6f25",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf68acd840b6a5bfd3777e0d5aaa204db6b461a9",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-8e4aedf0",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf68acd840b6a5bfd3777e0d5aaa204db6b461a9",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-9b76e4ad",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-d24512e8",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-d822dcd2",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5",
"deprecated": false
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-46743-da7e451a",
"target": {
"file": "drivers/of/irq.c",
"function": "of_irq_parse_one"
},
"digest": {
"length": 996.0,
"function_hash": "55986363513448217550973412954568301562"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ff351ea12e918db1373b915c4c268815929cbe5",
"deprecated": false
},
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-46743-fd2e3b02",
"target": {
"file": "drivers/of/irq.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262512775307363034783236294882086611378",
"122300822543382471015811527865320247686",
"118639202168551580794597247063938222004",
"312672407126329151432980237185719391552",
"316172294615794072652977038925058128343",
"174822720776699750182853474353817449426",
"39560821221108845468937859732991720153",
"127705570005889997481824892256426588221",
"69132654826588676928027884303793156161",
"162648061786050828538384722456542051362",
"134648619180286147638611766324440526540",
"276615663146464077712876153527490067679",
"337978287704667235816889078910734308634",
"39849134942400906623609000327293426786",
"68139008199238300850613090998008760267",
"277865866336376465279216474025619119072"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ff351ea12e918db1373b915c4c268815929cbe5",
"deprecated": false
}
]