CVE-2024-40963: mips: bmips: BCM6358: make sure CBR is correctly set
In the Linux kernel, the following vulnerability has been resolved:
mips: bmips: BCM6358: make sure CBR is correctly set
It was discovered that some device have CBR address set to 0 causing kernel panic when archsyncdmaforcpuall is called.
This was notice in situation where the system is booted from TP1 and BMIPSGETCBR() returns 0 instead of a valid address and !!(readc0brcmcmtlocal() & (1 << 31)); not failing.
The current check whether RAC flush should be disabled or not are not enough hence lets check if CBR is a valid address or not.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40963?
CVE-2024-40963 has been classified with a moderate severity level due to its potential to cause kernel panic.
How do I fix CVE-2024-40963?
To resolve CVE-2024-40963, update the Linux kernel to one of the following versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
What systems are affected by CVE-2024-40963?
CVE-2024-40963 affects devices running specific versions of the Linux kernel that have the CBR address improperly configured.
What does CBR stand for in the context of CVE-2024-40963?
In CVE-2024-40963, CBR refers to the Commit Bus Register, which is critical for preventing kernel panics in certain scenarios.
What happens if CVE-2024-40963 is exploited?
Exploiting CVE-2024-40963 can lead to a kernel panic, causing the affected device to crash and become unresponsive.