In the Linux kernel, the following vulnerability has been resolved:
of/irq: Prevent device address out-of-bounds read in interrupt map walk
When ofirqparseraw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func ofirqparse* +p"):
OF: ofirqparseone: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: ofirqparseraw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in ofirqparse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764
CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokiasmarm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dumpbacktrace+0xdc/0x130 showstack+0x1c/0x30 dumpstacklvl+0x6c/0x84 printreport+0x150/0x448 kasanreport+0x98/0x140 _asanload4+0x78/0xa0 ofirqparseraw+0x2b8/0x8d0 ofirqparseone+0x24c/0x270 parseinterrupts+0xc0/0x120 offwnodeaddlinks+0x100/0x2d0 fwdevlinkparsefwtree+0x64/0xc0 deviceadd+0xb38/0xc30 ofdeviceadd+0x64/0x90 ofplatformdevicecreatepdata+0xd0/0x170 ofplatformbuscreate+0x244/0x600 ofplatformnotify+0x1b0/0x254 blockingnotifiercallchain+0x9c/0xd0 _ofchangesetentrynotify+0x1b8/0x230 _ofchangesetapplynotify+0x54/0xe4 ofoverlayfdt_apply+0xc04/0xd94 ...
The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680)
The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compoundmapcount:0 compoundpincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it !
Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@defcaa426ba0bc89ffdafb799d2e50b52f74ffc4", "signature_version": "v1", "target": { "file": "drivers/of/irq.c", "function": "of_irq_parse_one" }, "digest": { "length": 996.0, "function_hash": "55986363513448217550973412954568301562" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-46743-0fb51ccd" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@defcaa426ba0bc89ffdafb799d2e50b52f74ffc4", "signature_version": "v1", "target": { "file": "drivers/of/irq.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "262512775307363034783236294882086611378", "122300822543382471015811527865320247686", "118639202168551580794597247063938222004", "312672407126329151432980237185719391552", "316172294615794072652977038925058128343", "174822720776699750182853474353817449426", "39560821221108845468937859732991720153", "127705570005889997481824892256426588221", "69132654826588676928027884303793156161", "162648061786050828538384722456542051362", "134648619180286147638611766324440526540", "276615663146464077712876153527490067679", "337978287704667235816889078910734308634", "39849134942400906623609000327293426786", "68139008199238300850613090998008760267", "277865866336376465279216474025619119072" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-46743-3d0cbe2b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5", "signature_version": "v1", "target": { "file": "drivers/of/irq.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "262512775307363034783236294882086611378", "122300822543382471015811527865320247686", "118639202168551580794597247063938222004", "312672407126329151432980237185719391552", "316172294615794072652977038925058128343", "174822720776699750182853474353817449426", "39560821221108845468937859732991720153", "127705570005889997481824892256426588221", "69132654826588676928027884303793156161", "162648061786050828538384722456542051362", "134648619180286147638611766324440526540", "276615663146464077712876153527490067679", "337978287704667235816889078910734308634", "39849134942400906623609000327293426786", "68139008199238300850613090998008760267", "277865866336376465279216474025619119072" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-46743-61a51927" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305", "signature_version": "v1", "target": { "file": "drivers/of/irq.c", "function": "of_irq_parse_one" }, "digest": { "length": 996.0, "function_hash": "55986363513448217550973412954568301562" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-46743-9b76e4ad" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305", "signature_version": "v1", "target": { "file": "drivers/of/irq.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "262512775307363034783236294882086611378", "122300822543382471015811527865320247686", "118639202168551580794597247063938222004", "312672407126329151432980237185719391552", "316172294615794072652977038925058128343", "174822720776699750182853474353817449426", "39560821221108845468937859732991720153", "127705570005889997481824892256426588221", "69132654826588676928027884303793156161", "162648061786050828538384722456542051362", "134648619180286147638611766324440526540", "276615663146464077712876153527490067679", "337978287704667235816889078910734308634", "39849134942400906623609000327293426786", "68139008199238300850613090998008760267", "277865866336376465279216474025619119072" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-46743-d24512e8" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5", "signature_version": "v1", "target": { "file": "drivers/of/irq.c", "function": "of_irq_parse_one" }, "digest": { "length": 996.0, "function_hash": "55986363513448217550973412954568301562" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-46743-d822dcd2" } ]