cve-2024-35994
Vulnerability from cvelistv5
Published
2024-05-20 09:47
Modified
2024-11-05 09:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It turns out that while the QSEECOM APP_SEND command has specific fields for request and response buffers, uefisecapp expects them both to be in a single memory region. Failure to adhere to this has (so far) resulted in either no response being written to the response buffer (causing an EIO to be emitted down the line), the SCM call to fail with EINVAL (i.e., directly from TZ/firmware), or the device to be hard-reset. While this issue can be triggered deterministically, in the current form it seems to happen rather sporadically (which is why it has gone unnoticed during earlier testing). This is likely due to the two kzalloc() calls (for request and response) being directly after each other. Which means that those likely return consecutive regions most of the time, especially when not much else is going on in the system. Fix this by allocating a single memory region for both request and response buffers, properly aligning both structs inside it. This unfortunately also means that the qcom_scm_qseecom_app_send() interface needs to be restructured, as it should no longer map the DMA regions separately. Therefore, move the responsibility of DMA allocation (or mapping) to the caller.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259
Impacted products
Vendor Product Version
Linux Linux Version: 6.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:05:44.255812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:52.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
            "drivers/firmware/qcom/qcom_scm.c",
            "include/linux/firmware/qcom/qcom_qseecom.h",
            "include/linux/firmware/qcom/qcom_scm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd22b34fb53c",
              "status": "affected",
              "version": "759e7a2b62eb",
              "versionType": "git"
            },
            {
              "lessThan": "ed09f81eeaa8",
              "status": "affected",
              "version": "759e7a2b62eb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
            "drivers/firmware/qcom/qcom_scm.c",
            "include/linux/firmware/qcom/qcom_qseecom.h",
            "include/linux/firmware/qcom/qcom_scm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:26:25.256Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
        }
      ],
      "title": "firmware: qcom: uefisecapp: Fix memory related IO errors and crashes",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35994",
    "datePublished": "2024-05-20T09:47:58.396Z",
    "dateReserved": "2024-05-17T13:50:33.147Z",
    "dateUpdated": "2024-11-05T09:26:25.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35994\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:13.530\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\\n\\nIt turns out that while the QSEECOM APP_SEND command has specific fields\\nfor request and response buffers, uefisecapp expects them both to be in\\na single memory region. Failure to adhere to this has (so far) resulted\\nin either no response being written to the response buffer (causing an\\nEIO to be emitted down the line), the SCM call to fail with EINVAL\\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\\n\\nWhile this issue can be triggered deterministically, in the current form\\nit seems to happen rather sporadically (which is why it has gone\\nunnoticed during earlier testing). This is likely due to the two\\nkzalloc() calls (for request and response) being directly after each\\nother. Which means that those likely return consecutive regions most of\\nthe time, especially when not much else is going on in the system.\\n\\nFix this by allocating a single memory region for both request and\\nresponse buffers, properly aligning both structs inside it. This\\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\\nneeds to be restructured, as it should no longer map the DMA regions\\nseparately. Therefore, move the responsibility of DMA allocation (or\\nmapping) to the caller.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: qcom: uefisecapp: corrige errores y bloqueos de E/S relacionados con la memoria. Resulta que, si bien el comando QSEECOM APP_SEND tiene campos espec\u00edficos para los buffers de solicitud y respuesta, uefisecapp espera que ambos est\u00e9n en una \u00fanica regi\u00f3n de memoria. El incumplimiento de esto ha dado como resultado (hasta ahora) que no se escriba ninguna respuesta en el b\u00fafer de respuesta (lo que provoca que se emita un EIO en el futuro), que la llamada SCM falle con EINVAL (es decir, directamente desde TZ/firmware), o el dispositivo para ser reiniciado. Si bien este problema puede desencadenarse de manera determinista, en la forma actual parece ocurrir de manera bastante espor\u00e1dica (raz\u00f3n por la cual pas\u00f3 desapercibido durante las pruebas anteriores). Es probable que esto se deba a que las dos llamadas a kzalloc() (para solicitud y respuesta) est\u00e1n directamente una detr\u00e1s de la otra. Lo que significa que es probable que regresen a regiones consecutivas la mayor parte del tiempo, especialmente cuando no sucede mucho m\u00e1s en el sistema. Solucione este problema asignando una \u00fanica regi\u00f3n de memoria para los b\u00faferes de solicitud y respuesta, alineando adecuadamente ambas estructuras dentro de ella. Lamentablemente, esto tambi\u00e9n significa que la interfaz qcom_scm_qseecom_app_send() debe reestructurarse, ya que ya no deber\u00eda asignar las regiones DMA por separado. Por lo tanto, traslade la responsabilidad de la asignaci\u00f3n (o mapeo) de DMA a la persona que llama.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.