In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
firmware: arm_scmi: Reject out of range DT protocol IDs<\/p>\n
SCMI protocol IDs carried in message headers are limited by
\nMSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs
\noutside that range, but only logged an error and then kept processing
\nthe invalid value.<\/p>\n
That lets a malformed 32-bit DT reg value reach helpers which take a u8
\nprotocol ID, where it can be truncated and\/or treated as a different
\nprotocol.<\/p>\n
For channel setup, two different out-of-range values can also be used as
\ndistinct IDR keys while aliasing the generated SCMI protocol identity.<\/p>\n
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID
\nfield before setting up channels or creating protocol devices.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
firmware: arm_scmi: Reject out of range DT protocol IDs<\/p>\n
SCMI protocol IDs carried in message headers are limited by
\nMSG_PROTOCOL_I<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25944","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}