// For flags

CVE-2023-52488

serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

The SC16IS7XX IC supports a burst mode to access the FIFOs where the
initial register address is sent ($00), followed by all the FIFO data
without having to resend the register address each time. In this mode, the
IC doesn't increment the register address for each R/W byte.

The regmap_raw_read() and regmap_raw_write() are functions which can
perform IO over multiple registers. They are currently used to read/write
from/to the FIFO, and although they operate correctly in this burst mode on
the SPI bus, they would corrupt the regmap cache if it was not disabled
manually. The reason is that when the R/W size is more than 1 byte, these
functions assume that the register address is incremented and handle the
cache accordingly.

Convert FIFO R/W functions to use the regmap _noinc_ versions in order to
remove the manual cache control which was a workaround when using the
_raw_ versions. FIFO registers are properly declared as volatile so
cache will not be used/updated for FIFO accesses.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: sc16is7xx: convierte de _raw_ a _noinc_ funciones regmap para FIFO El IC SC16IS7XX admite un modo de ráfaga para acceder a los FIFO donde se envía la dirección de registro inicial ($00), seguida de todas los datos FIFO sin tener que reenviar la dirección de registro cada vez. En este modo, el IC no incrementa la dirección de registro para cada byte de lectura/escritura. regmap_raw_read() y regmap_raw_write() son funciones que pueden realizar IO en múltiples registros. Actualmente se utilizan para leer/escribir desde/hacia FIFO y, aunque funcionan correctamente en este modo de ráfaga en el bus SPI, dañarían el caché de regmap si no se desactivara manualmente. La razón es que cuando el tamaño de lectura y escritura es superior a 1 byte, estas funciones asumen que la dirección del registro se incrementa y manejan la caché en consecuencia. Convierta las funciones FIFO R/W para usar las versiones regmap _noinc_ para eliminar el control de caché manual, que era una solución alternativa al usar las versiones _raw_. Los registros FIFO se declaran correctamente como volátiles, por lo que la caché no se utilizará ni se actualizará para los accesos FIFO.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-20 CVE Reserved
  • 2024-02-29 CVE Published
  • 2024-04-14 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 5.10.215
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 5.10.215"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 5.15.154
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 5.15.154"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 6.1.76
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.1.76"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 6.6.15
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.6.15"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 6.7.3
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.7.3"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.16 < 6.8
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.8"
en
Affected