CVE-2016-10764: Buffer Overflow
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspisetupflash() function. There are CQSPIMAXCHIPSELECT elements in the ->fpdata array so the ">" should be ">=" instead.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running Linux kernel versions before 4.9.6 are affected if they use the Cadence QuadSPI NOR flash driver in drivers/mtd/spi-nor/cadence-quadspi.c.
What access does an attacker need to exploit it?
The available CVSS vector rates the issue as network-accessible, low complexity, requiring no privileges or user interaction. Successful exploitation can affect confidentiality, integrity, and availability.
How can I determine whether the system is affected?
Check whether the running kernel is earlier than 4.9.6 and whether the Cadence QuadSPI driver is present or used. The defect is in cqspi_setup_flash() and involves a chip-select bounds check against the f_pdata array.
What is the remediation?
Apply the available patch, which corrects the chip-select boundary check from a greater-than comparison to a greater-than-or-equal comparison.