CVE-2021-47282
- Source
- https://cve.org/CVERecord?id=CVE-2021-47282
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47282.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47282
- Downstream
- Published
- 2024-05-21T15:15:16.430Z
- Modified
- 2026-03-10T23:51:35.210747Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
Commit 571e31fa60b3 ("spi: bcm2835: Cache CS register value for ->preparemessage()") limited the number of slaves to 3 at compile-time. The limitation was necessitated by a statically-sized array preparecs[] in the driver private data which contains a per-slave register value.
The commit sought to enforce the limitation at run-time by setting the controller's numchipselect to 3: Slaves with a higher chipselect are rejected by spiadd_device().
However the commit neglected that numchipselect only limits the number of native chipselects. If GPIO chipselects are specified in the device tree for more than 3 slaves, numchipselect is silently raised by ofspigetgpionumbers() and the result are out-of-bounds accesses to the statically-sized array prepare_cs[].
As a bandaid fix which is backportable to stable, raise the number of allowed slaves to 24 (which "ought to be enough for anybody"), enforce the limitation on slave ->setup and revert num_chipselect to 3 (which is the number of native chipselects supported by the controller). An upcoming for-next commit will allow an arbitrary number of slaves.
- References
Affected packages
Git /
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47282.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "5.4"
},
{
"fixed": "5.4.126"
}
]
},
{
"events": [
{
"introduced": "5.5"
},
{
"fixed": "5.10.44"
}
]
},
{
"events": [
{
"introduced": "5.11"
},
{
"fixed": "5.12.11"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.13-rc1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.13-rc2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.13-rc3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.13-rc4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.13-rc5"
}
]
}
]