// For flags

CVE-2024-26893

firmware: arm_scmi: Fix double free in SMC transport cleanup path

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix double free in SMC transport cleanup path

When the generic SCMI code tears down a channel, it calls the chan_free
callback function, defined by each transport. Since multiple protocols
might share the same transport_info member, chan_free() might want to
clean up the same member multiple times within the given SCMI transport
implementation. In this case, it is SMC transport. This will lead to a NULL
pointer dereference at the second time:

| scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16
| arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
| arm-scmi firmware:scmi: unable to communicate with SCMI
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
| Mem abort info:
| ESR = 0x0000000096000004
| EC = 0x25: DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x04: level 0 translation fault
| Data abort info:
| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
| CM = 0, WnR = 0, TnD = 0, TagAccess = 0
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000
| [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793
| Hardware name: FVP Base RevC (DT)
| pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
| pc : smc_chan_free+0x3c/0x6c
| lr : smc_chan_free+0x3c/0x6c
| Call trace:
| smc_chan_free+0x3c/0x6c
| idr_for_each+0x68/0xf8
| scmi_cleanup_channels.isra.0+0x2c/0x58
| scmi_probe+0x434/0x734
| platform_probe+0x68/0xd8
| really_probe+0x110/0x27c
| __driver_probe_device+0x78/0x12c
| driver_probe_device+0x3c/0x118
| __driver_attach+0x74/0x128
| bus_for_each_dev+0x78/0xe0
| driver_attach+0x24/0x30
| bus_add_driver+0xe4/0x1e8
| driver_register+0x60/0x128
| __platform_driver_register+0x28/0x34
| scmi_driver_init+0x84/0xc0
| do_one_initcall+0x78/0x33c
| kernel_init_freeable+0x2b8/0x51c
| kernel_init+0x24/0x130
| ret_from_fork+0x10/0x20
| Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)
| ---[ end trace 0000000000000000 ]---

Simply check for the struct pointer being NULL before trying to access
its members, to avoid this situation.

This was found when a transport doesn't really work (for instance no SMC
service), the probe routines then tries to clean up, and triggers a crash.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: Corrección de doble liberación en la ruta de limpieza del transporte SMC Cuando el código SCMI genérico destruye un canal, llama a la función de devolución de llamada chan_free, definida por cada transporte. Dado que varios protocolos pueden compartir el mismo miembro transport_info, es posible que chan_free() desee limpiar el mismo miembro varias veces dentro de la implementación de transporte SCMI determinada. En este caso se trata de transporte SMC. Esto dará lugar a una desreferencia del puntero NULL la segunda vez: | scmi_protocol scmi_dev.1: Canal TX en modo de sondeo habilitado - prot_id:16 | firmware arm-scmi: scmi: Notificaciones SCMI: núcleo habilitado. | firmware arm-scmi: scmi: no se puede comunicar con SCMI | No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 0000000000000000 | Información de cancelación de memoria: | ESR = 0x0000000096000004 | EC = 0x25: DABT (EL actual), IL = 32 bits | CONJUNTO = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: error de traducción de nivel 0 | Información de cancelación de datos: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, Acceso a etiquetas = 0 | GCS = 0, Superposición = 0, DirtyBit = 0, Xs = 0 | pgtable de usuario: páginas de 4k, VA de 48 bits, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Error interno: Ups: 0000000096000004 [#1] SMP ANTICIPADO | Módulos enlazados en: | CPU: 4 PID: 1 Comunicaciones: swapper/0 No contaminado 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Nombre del hardware: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | ordenador personal: smc_chan_free+0x3c/0x6c | lr: smc_chan_free+0x3c/0x6c | Rastreo de llamadas: | smc_chan_free+0x3c/0x6c | idr_for_each+0x68/0xf8 | scmi_cleanup_channels.isra.0+0x2c/0x58 | scmi_probe+0x434/0x734 | sonda_plataforma+0x68/0xd8 | realmente_probe+0x110/0x27c | __driver_probe_device+0x78/0x12c | dispositivo_sonda_controlador+0x3c/0x118 | __driver_attach+0x74/0x128 | bus_for_each_dev+0x78/0xe0 | driver_attach+0x24/0x30 | bus_add_driver+0xe4/0x1e8 | registro_controlador+0x60/0x128 | __platform_driver_register+0x28/0x34 | scmi_driver_init+0x84/0xc0 | do_one_initcall+0x78/0x33c | kernel_init_freeable+0x2b8/0x51c | kernel_init+0x24/0x130 | ret_from_fork+0x10/0x20 | Código: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]--- Simplemente verifique que el puntero de estructura sea NULL antes de intentar acceder a sus miembros, para evitar esta situación. Esto se encontró cuando un transporte realmente no funciona (por ejemplo, sin servicio SMC), las rutinas de la sonda intentan limpiarse y provocan un bloqueo.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-19 CVE Reserved
  • 2024-04-17 CVE Published
  • 2024-04-18 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 6.1.83
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 6.1.83"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 6.6.23
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 6.6.23"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 6.7.11
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 6.7.11"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 6.8.2
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 6.8.2"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.8 < 6.9
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.8 < 6.9"
en
Affected