Vulnerability-Lookup

GHSA-JVRG-CVPM-4P85

Vulnerability from github – Published: 2024-08-07 18:30 – Updated: 2024-08-08 21:32

Details

In the Linux kernel, the following vulnerability has been resolved:

spi: don't unoptimize message in spi_async()

Calling spi_maybe_unoptimize_message() in spi_async() is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the controller driver.

spi_maybe_unoptimize_message() is already called in the correct place in spi_finalize_current_message() to balance the call to spi_maybe_optimize_message() in spi_async().

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-42249"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-07T16:15:47Z",
    "severity": "LOW"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: don\u0027t unoptimize message in spi_async()\n\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\nthe message is likely to be in the queue and not transferred yet. This\ncan corrupt the message while it is being used by the controller driver.\n\nspi_maybe_unoptimize_message() is already called in the correct place\nin spi_finalize_current_message() to balance the call to\nspi_maybe_optimize_message() in spi_async().",
  "id": "GHSA-jvrg-cvpm-4p85",
  "modified": "2024-08-08T21:32:01Z",
  "published": "2024-08-07T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42249"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-42249 (GCVE-0-2024-42249)

Vulnerability from cvelistv5 – Published: 2024-08-07 15:14 – Updated: 2026-08-05 11:36

Title

spi: don't unoptimize message in spi_async()

Summary

In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in spi_async() is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the controller driver. spi_maybe_unoptimize_message() is already called in the correct place in spi_finalize_current_message() to balance the call to spi_maybe_optimize_message() in spi_async().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:13 UTC

Assigner

Linux mitre root Scorecard

References

2 references

URL	Tags
https://git.kernel.org/stable/c/8b9af6d67517ce4a0…
https://git.kernel.org/stable/c/c86a918b1bdba78fb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02 , < 8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2 (git) Affected: 7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02 , < c86a918b1bdba78fb155184f8d88dfba1e63335d (git)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.9.10 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:22.174843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:30.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2",
              "status": "affected",
              "version": "7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02",
              "versionType": "git"
            },
            {
              "lessThan": "c86a918b1bdba78fb155184f8d88dfba1e63335d",
              "status": "affected",
              "version": "7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: don\u0027t unoptimize message in spi_async()\n\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\nthe message is likely to be in the queue and not transferred yet. This\ncan corrupt the message while it is being used by the controller driver.\n\nspi_maybe_unoptimize_message() is already called in the correct place\nin spi_finalize_current_message() to balance the call to\nspi_maybe_optimize_message() in spi_async()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the SPI core and is reached by causing local SPI traffic \u2014 a `/dev/spidevB.C` SPI_IOC_MESSAGE ioctl behind spi-mux, IIO buffer enable, regmap-async firmware download via an ALSA device, or netdev TX on an SPI transceiver. No network protocol parses attacker data here, so exploitation requires local system access.\nAC:L - The attacker controls both sides of the race \u2014 they submit the `spi_async()` messages that queue the work and simultaneously trigger the unsynchronized teardown, and can repeat this thousands of times per second from multiple threads to widen the window and groom the freed slab. On spi-axi-spi-engine the free reliably wins, yielding a deterministic NULL deref of `msg-\u003eopt_state`.\nPR:L - An ordinary unprivileged local user suffices: spidev nodes are commonly group-readable/writable on embedded and SBC images, IIO buffer sysfs and ALSA PCM/firmware-download paths are similarly group-accessible, and CAN/802.15.4 socket TX drives `spi_async()` too. No root or capability in the init namespace is needed.\nUI:N - The attacker\u0027s own syscalls generate the SPI messages that race with the controller worker; no action by any other user is required.\nS:U - The corruption is confined to kernel slab memory and the SPI core\u0027s own data structures, all within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free lets the controller read `tx_buf`/`rx_buf`/`len` out of a freed and reallocatable `struct spi_transfer`, so arbitrary kernel memory can be clocked out on the SPI bus and received data DMA\u0027d to an attacker-influenced address; the freed spi-engine program is likewise pushed byte-for-byte into the hardware command FIFO.\nI:H - `spi_res_release()` can run twice on the same message (the unlocked `msg-\u003eoptimized` check-and-clear races with `spi_finalize_current_message()`), giving a double free of a kmalloc\u0027d object plus concurrent `list_splice`/`list_del` against live list traversal \u2014 SLUB freelist and linked-list corruption that yields a write primitive.\nA:H - In the common case the free wins and `spi_engine_transfer_one_message()` dereferences a NULL `msg-\u003eopt_state`, and list corruption or a restored oversized transfer likewise oopses the kernel \u2014 an immediate panic that an unprivileged user can trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:03.625Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d"
        }
      ],
      "title": "spi: don\u0027t unoptimize message in spi_async()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42249",
    "datePublished": "2024-08-07T15:14:33.418Z",
    "dateReserved": "2024-07-30T07:40:12.255Z",
    "dateUpdated": "2026-08-05T11:36:03.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JVRG-CVPM-4P85

CVE-2024-42249 (GCVE-0-2024-42249)

Tags

Sightings

Nomenclature

Related by attack behaviour