CVE-2021-47048: Linux Kernel Vulnerability Resolved in spi-zynqmp-gqspi Module

Summary: A recent vulnerability has been discovered in the Linux kernel's spi-zynqmp-gqspi module, which could lead to a use-after-free issue. The Linux kernel team has released a patch to address the issue, now identified as CVE-2021-47048.

Hello, Linux Kernel users!

A recently discovered vulnerability (CVE-2021-47048) in the Linux kernel has been resolved, thanks to a patch addressing the use-after-free issue that could lead to potential exploits. In this post, we will dive into the details of the vulnerability, the affected module (spi-zynqmp-gqspi), and the code snippet showcasing the fix that has been implemented.

The Vulnerability: Use-After-Free in spi-zynqmp-gqspi

The vulnerability specifically affects the spi-zynqmp-gqspi module, which is part of the Linux kernel's Serial Peripheral Interface (SPI) subsystem. In the original implementation, the tmpbuf buffer was being used to handle the op->addr field after it had already been freed, leading to a potential use-after-free issue and triggering a Kernel Address Sanitizer (KASAN) warning.

Original References

- Linux kernel patch submission
- CVE-2021-47048 tracking

Exploit Details

The exploit relies on the use-after-free scenario, which could be exploited by an attacker to execute arbitrary code or manipulate data structures in unexpected ways. However, the team responsible for the Linux kernel has acted quickly to address the issue and released a patch to mitigate the risk.

The Fix: Code Snippet

The fix implemented by the development team involves using temporary variables to store the values of op->addr.val and op->cmd.opcode, thus preventing the use-after-free scenario. Here's the code snippet demonstrating the change:

static int zynqmp_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
{
    /* ... */

-   /* Handling op->addr */
-   tmpbuf = kmemdup(op->addr.buf, op->addr.nbytes, GFP_KERNEL);
-   if (!tmpbuf)
-       return -ENOMEM;

+   /* Use temporary variables to store op->addr.val & op->cmd.opcode */
+   u64 tmp_addr = op->addr.val;
+   u8 op_code = op->cmd.opcode;

    /* ... */

-   if (!(tmpbuf[] & x1)) {
+   if (!(op_code & x1)) {
        /* ... */

-       ret = zynqmp_qspi_write_op(conf, &tmpbuf[1], ret);
+       ret = zynqmp_qspi_write_op(conf, &tmp_addr, ret);

        /* ... */
    }

    /* ... */

-   kfree(tmpbuf);
    return ret;
}

By implementing this simple change, the vulnerability has been resolved, making the Linux kernel's spi-zynqmp-gqspi module safe from potential exploit attempts.

In conclusion, Linux kernel users should update their systems to include the patch addressing CVE-2021-47048 and make sure they're aware of this important security update. We hope this post has provided a clear and informative overview of the vulnerability and its resolution.

Timeline

Published on: 02/28/2024 09:15:40 UTC
Last modified on: 12/09/2024 19:05:02 UTC