In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE<\/p>\n
qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD\/NAND_EXEC_CMD and submits
\nthe descriptors, which makes the controller execute the command
\nimmediately. For SPINAND_SET_FEATURE the value to be written is only
\nplaced into NAND_FLASH_FEATURES afterwards, by qcom_spi_io_op(), in a
\nsecond submission – so the chip is programmed with whatever that register
\nhappened to hold from a previous operation, and the intended value is only
\napplied by the *next* SET_FEATURE.<\/p>\n
Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing
\n0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the
\nsubsequent write of 0x00 leaves it at 0x40 – every write lands one
\noperation late.<\/p>\n
This stayed unnoticed until v6.18 added SPI-NAND OTP support together
\nwith OTP entries for ESMT chips. spinand_otp_rw() enables OTP mode,
\nreads, and disables it again, and mtd_otp_nvmem_add() does this during
\nMTD registration. With the off-by-one, the “disable” write actually
\napplies the previously requested value, so CFG_OTP_ENABLE ends up set:
\nthe chip stays in OTP mode, every subsequent array read returns the OTP
\narea instead of the array (UBI reports an empty device) and all writes
\nfail with -EIO because the OTP area is write protected. On this board
\nthat makes the whole flash unusable and the device unbootable.<\/p>\n
Write the feature value into NAND_FLASH_FEATURES as part of the same
\ntransaction, before NAND_EXEC_CMD. While at it, copy only the bytes the
\noperation actually carries – the previous code dereferenced a 4-byte
\npointer on a one-byte buffer (spinand->scratchbuf).<\/p>\n
With this patch the flash contents read back bit-identical to a
\nknown-good dump of the same board taken under the vendor firmware
\n(md5-verified across partitions), and writes work.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE<\/p>\n
qcom_spi_send_cmdaddr() programs NAND_FLASH_CMD\/NAND_EXE<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12354","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}