CVE-2024-26807
published 2024-04-04CVE-2024-26807: In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
13.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
Both cadence-quadspi ->runtime_suspend() and ->runtime_resume()
implementations start with:
struct cqspi_st *cqspi = dev_get_drvdata(dev);
struct spi_controller *host = dev_get_drvdata(dev);
This obviously cannot be correct, unless "struct cqspi_st" is the
first member of " struct spi_controller", or the other way around, but
it is not the case. "struct spi_controller" is allocated by
devm_spi_alloc_host(), which allocates an extra amount of memory for
private data, used to store "struct cqspi_st".
The ->probe() function of the cadence-quadspi driver then sets the
device drvdata to store the address of the "struct cqspi_st"
structure. Therefore:
struct cqspi_st *cqspi = dev_get_drvdata(dev);
is correct, but:
struct spi_controller *host = dev_get_drvdata(dev);
is not, as it makes "host" point not to a "struct spi_controller" but
to the same "struct cqspi_st" structure as above.
This obviously leads to bad things (memory corruption, kernel crashes)
directly during ->probe(), as ->probe() enables the device using PM
runtime, leading the ->runtime_resume() hook being called, which in
turns calls spi_controller_resume() with the wrong pointer.
This has at least been reported [0] to cause a kernel crash, but the
exact behavior will depend on the memory contents.
[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/
This issue potentially affects all platforms that are currently using
the cadence-quadspi driver.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.140-1 (bookworm) | linux 6.1.140-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.140-1 (bookworm) | linux 6.1.140-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 2087e85bb66ee3652dafe732bb9b9b896229eafc < 03f1573c9587029730ca68503f5062105b122f61 | 03f1573c9587029730ca68503f5062105b122f61 |
| linux | linux | >= 2087e85bb66ee3652dafe732bb9b9b896229eafc < 34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03 | 34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03 |
| linux | linux | >= 2087e85bb66ee3652dafe732bb9b9b896229eafc < 32ce3bb57b6b402de2aec1012511e7ac4e7449dc | 32ce3bb57b6b402de2aec1012511e7ac4e7449dc |
| linux | linux | >= 4.19.283 < 4.20 | 4.20 |
| linux | linux | >= 5.10.180 < 5.11 | 5.11 |
| linux | linux | >= 5.15.111 < 5.16 | 5.16 |
| linux | linux | >= 5.4.243 < 5.5 | 5.5 |
| linux | linux | >= 6.1.28 < 6.1.140 | 6.1.140 |
| linux | linux | >= 6.2.15 < 6.3 | 6.3 |
| linux | linux | >= 6.3.2 < 6.4 | 6.4 |
| linux | linux | >= 79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c < 2c914aac9522f6e93822c18dff233d3e92399c81 | 2c914aac9522f6e93822c18dff233d3e92399c81 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8xc6-54p8-3p65: In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-qspi: fix pointer reference in runtime PM hooks
dev_get_drvdata() g
ghsa_unreviewed·2024-04-04
CVE-2024-26807 [MEDIUM] CWE-787 GHSA-8xc6-54p8-3p65: In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-qspi: fix pointer reference in runtime PM hooks
dev_get_drvdata() g
In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-qspi: fix pointer reference in runtime PM hooks
dev_get_drvdata() gets used to acquire the pointer to cqspi and the SPI
controller. Neither embed the other; this lead to memory corruption.
On a given platform (Mobileye EyeQ5) the memory corruption is hidden
inside cqspi->f_pdata. Also, this uninitialised memory is used as a
mutex (ctlr->bus_lock_mutex) by spi_controller_suspend().
OSV
CVE-2024-26807: In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations st
osv·2024-04-04·CVSS 5.5
CVE-2024-26807 [MEDIUM] CVE-2024-26807: In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations st
In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st". The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore: struct cqspi_st *cqspi = dev_get_drvdata(dev); is correct, but: struct spi_con
Red Hat
kernel: spi: cadence-qspi: fix pointer reference in runtime PM hooks
vendor_redhat·2024-04-04·CVSS 5.5
CVE-2024-26807 [MEDIUM] CWE-822 kernel: spi: cadence-qspi: fix pointer reference in runtime PM hooks
kernel: spi: cadence-qspi: fix pointer reference in runtime PM hooks
In the Linux kernel, the following vulnerability has been resolved:
Both cadence-quadspi ->runtime_suspend() and ->runtime_resume()
implementations start with:
struct cqspi_st *cqspi = dev_get_drvdata(dev);
struct spi_controller *host = dev_get_drvdata(dev);
This obviously cannot be correct, unless "struct cqspi_st" is the
first member of " struct spi_controller", or the other way around, but
it is not the case. "struct spi_controller" is allocated by
devm_spi_alloc_host(), which allocates an extra amount of memory for
private data, used to store "struct cqspi_st".
The ->probe() function of the cadence-quadspi driver then sets the
device drvdata to store the address of the "struct cqspi_st"
structure. Therefore:
struct c
Debian
CVE-2024-26807: linux - In the Linux kernel, the following vulnerability has been resolved: Both cadenc...
vendor_debian·2024·CVSS 5.5
CVE-2024-26807 [MEDIUM] CVE-2024-26807: linux - In the Linux kernel, the following vulnerability has been resolved: Both cadenc...
In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st". The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore: struct cqspi_st *cqspi = dev_get_drvdata(dev); is correct, but: struct spi_con
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dchttps://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dchttps://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html
2024-04-04
Published