Описание
In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked (or the few first blocks), if the user want to fully unlock the device it has two possibilities:
- either it asks to unlock the entire device, and this works;
- or it asks to unlock just the block(s) that are currently locked,
which fails.
It fails because the conditions "can_be_top" and "can_be_bottom" are
true. Indeed, in this case, we unlock everything, so the TB bit does not
matter. However in the current implementation, use_top would be true (as
this is the favourite option) and lock_len, which in practice should be
reduced down to 0, is set to "nor->params->size - (ofs + len)" which is
a positive number. This is wrong.
An easy way is to simply add an extra condition. In the unlock() path,
if we can achieve the same result from both sides, it means we unlock
everything and lock_len must simply be 0. A comment is added to clarify
that logic.
A flaw was found in the Linux kernel'smtd: spi-nor: swpcomponent. When a user attempts to unlock specific blocks on a Serial Peripheral Interface (SPI) NOR flash device, particularly those at the beginning of the device, the operation may fail. This occurs due to an incorrect calculation of thelock_lenparameter, which prevents the intended blocks from being unlocked. The consequence is that the user's request to unlock certain flash memory regions is not properly executed, potentially leading to unexpected device behavior or operational limitations.
Отчет
A low impact flaw was found in the Linux kernel SPI NOR flash memory software write protection (mtd: spi-nor: swp) implementation. When the first block or first few blocks of a SPI NOR flash device are locked and a user with local access and the privileges needed to change SPI NOR write protection requests to unlock only those currently locked blocks, the operation fails because lock_len is incorrectly calculated as a positive value (nor->params->size - (ofs + len)) instead of 0. This local functional defect in the flash protection control path can prevent expected write or update operations on the affected flash regions; there is no evidence of memory corruption, information disclosure, or privilege escalation, and confidentiality is not affected. Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those releases. Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected; the fix has been deferred to a future update given the low security impact of this functional bug. The residual risk is limited to the failure of block-level unlock requests, since the device can still be fully unlocked by requesting an unlock of the entire device. Red Hat rates the impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 (Moderate) reflects a high availability impact, because the defect only affects the SPI NOR unlock operation under specific block-locking configurations.
Меры по смягчению последствий
A workaround is available: instead of requesting an unlock of only the block(s) that are currently locked (for example the first block(s) of the device), request an unlock of the entire device, which succeeds. A fix for the affected Red Hat products is deferred and will be delivered in a future update.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked (or the few first blocks), if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire device, and this works; - or it asks to unlock just the block(s) that are currently locked, which fails. It fails because the conditions "can_be_top" and "can_be_bottom" are true. Indeed, in this case, we unlock everything, so the TB bit does not matter. However in the current implementation, use_top would be true (as this is the favourite option) and lock_len, which in practice should be reduced down to 0, is set to "nor->params->size - (ofs + len)" which is a positive number. This is wrong. An easy way is to simply add an extra condition. In the unlock() path, if we can achieve the same result from both sides, it means we unlock everything and lock_len must simply be 0. A comment is added...
In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked (or the few first blocks), if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire device, and this works; - or it asks to unlock just the block(s) that are currently locked, which fails. It fails because the conditions "can_be_top" and "can_be_bottom" are true. Indeed, in this case, we unlock everything, so the TB bit does not matter. However in the current implementation, use_top would be true (as this is the favourite option) and lock_len, which in practice should be reduced down to 0, is set to "nor->params->size - (ofs + len)" which is a positive number. This is wrong. An easy way is to simply add an extra condition. In the unlock() path, if we can achieve the same result from both sides, it means we unlock everything and lock_len must simply be 0. A comment is ad
In the Linux kernel, the following vulnerability has been resolved: m ...
EPSS
5.5 Medium
CVSS3