CVE-2023-53274

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

clk: mediatek: mt8183: Add back SSPM related clocks

This reverts commit 860690a93ef23b567f781c1b631623e27190f101.

On the MT8183, the SSPM related clocks were removed claiming a lack of

usage. This however causes some issues when the driver was converted to

the new simple-probe mechanism. This mechanism allocates enough space

for all the clocks defined in the clock driver, not the highest index

in the DT binding. This leads to out-of-bound writes if their are holes

in the DT binding or the driver (due to deprecated or unimplemented

clocks). These errors can go unnoticed and cause memory corruption,

leading to crashes in unrelated areas, or nothing at all. KASAN will

detect them.

Add the SSPM related clocks back to the MT8183 clock driver to fully

implement the DT binding. The SSPM clocks are for the power management

co-processor, and should never be turned off. They are marked as such.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References