CVE-2024-41088

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: mcp251xfd: fix infinite loop when xmit fails

When the mcp251xfd_start_xmit() function fails, the driver stops

processing messages, and the interrupt routine does not return,

running indefinitely even after killing the running application.

Error messages:

[ 441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16

[ 441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).

... and repeat forever.

The issue can be triggered when multiple devices share the same SPI

interface. And there is concurrent access to the bus.

The problem occurs because tx_ring->head increments even if

mcp251xfd_start_xmit() fails. Consequently, the driver skips one TX

package while still expecting a response in

mcp251xfd_handle_tefif_one().

Resolve the issue by starting a workqueue to write the tx obj

synchronously if err = -EBU

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References