CVE-2024-42279: spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
In the Linux kernel, the following vulnerability has been resolved:
spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
While transmitting with rxlen == 0, the RX FIFO is not going to be emptied in the interrupt handler. A subsequent transfer could then read crap from the previous transfer out of the RX FIFO into the start RX buffer. The core provides a register that will empty the RX and TX FIFOs, so do that before each transfer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42279?
CVE-2024-42279 has a moderate severity rating due to potential data corruption during SPI transfers.
How do I fix CVE-2024-42279?
To fix CVE-2024-42279, update to one of the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-42279?
CVE-2024-42279 affects the Linux kernel versions up to and including 6.1.123-1 and 6.1.119-1.
What does CVE-2024-42279 involve?
CVE-2024-42279 involves a flaw in the Linux kernel's SPI microchip-core handling where the RX FIFO may not be cleared correctly.
Is CVE-2024-42279 specific to Debian Linux?
CVE-2024-42279 is known to impact Debian's Linux versions but may also affect other distributions that use vulnerable kernel versions.