Bug 1224556 (CVE-2024-35994)

Summary: VUL-0: CVE-2024-35994: kernel: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: gianluca.gabrielli, jlee
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/406723/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-05-20 14:37:06 UTC 
In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: Fix memory related IO errors and crashes

It turns out that while the QSEECOM APP_SEND command has specific fields
for request and response buffers, uefisecapp expects them both to be in
a single memory region. Failure to adhere to this has (so far) resulted
in either no response being written to the response buffer (causing an
EIO to be emitted down the line), the SCM call to fail with EINVAL
(i.e., directly from TZ/firmware), or the device to be hard-reset.

While this issue can be triggered deterministically, in the current form
it seems to happen rather sporadically (which is why it has gone
unnoticed during earlier testing). This is likely due to the two
kzalloc() calls (for request and response) being directly after each
other. Which means that those likely return consecutive regions most of
the time, especially when not much else is going on in the system.

Fix this by allocating a single memory region for both request and
response buffers, properly aligning both structs inside it. This
unfortunately also means that the qcom_scm_qseecom_app_send() interface
needs to be restructured, as it should no longer map the DMA regions
separately. Therefore, move the responsibility of DMA allocation (or
mapping) to the caller.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35994
https://www.cve.org/CVERecord?id=CVE-2024-35994
https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88
https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35994.mbox
Comment 1 Joey Lee 2024-05-23 07:56:15 UTC 
joeyli@linux-691t:/mnt/working/source_code-git/kernel-source> ./scripts/check-kernel-fix -s 0 CVE-2024-35994
ed09f81eeaa8 ("firmware: qcom: uefisecapp: Fix memory related IO errors and crashes") merged v6.9-rc6~12^2~1^2
Fixes: 759e7a2b62eb ("firmware: Add support for Qualcomm UEFI Secure Application") merged v6.7-rc1~128^2~5^2~41
Security fix for CVE-2024-35994 bsc#1224556 with CVSS 0
Experts candidates: tiwai@suse.de 
..............................
NO ACTION NEEDED: All relevant branches contain the fix!

Does not affect any branch. reset assignee
Comment 2 Gabriele Sonnu 2024-06-10 12:49:14 UTC 
All done, closing.