Description
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
92270086b7e5ada7ab381c06cc3da2e95ed17088 to < 28ea836cc44cb8b89c1c174707ead0c1133c60e9affected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < fe4a73c3dd48308149d57a10c2761e1d36ced7baaffected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < ce5229e78078e437704157eb542f43a6f83b429baffected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < a80291e577b44593a724d6cd64c14337c78f194daffected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2affected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < 5fd5c078af23cb353507aa522e09d557d7eaef04affected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < f25446e2c28939753d3b62d34dfda49952b2557daffected92270086b7e5ada7ab381c06cc3da2e95ed17088 to < bab2bc6e850a697a23b9e5f0e21bb8c187615e95affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.20 to ≤ 6.18.*unaffected6.19.10 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/28ea836cc44cb8b89c1c174707ead0c1133c60e9 ↗
- https://git.kernel.org/stable/c/fe4a73c3dd48308149d57a10c2761e1d36ced7ba ↗
- https://git.kernel.org/stable/c/ce5229e78078e437704157eb542f43a6f83b429b ↗
- https://git.kernel.org/stable/c/a80291e577b44593a724d6cd64c14337c78f194d ↗
- https://git.kernel.org/stable/c/f71ce0ae5aefe39dd5b2f996c0e08550d2153ad2 ↗
- https://git.kernel.org/stable/c/5fd5c078af23cb353507aa522e09d557d7eaef04 ↗
- https://git.kernel.org/stable/c/f25446e2c28939753d3b62d34dfda49952b2557d ↗
- https://git.kernel.org/stable/c/bab2bc6e850a697a23b9e5f0e21bb8c187615e95 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗