CVE-2024-49853

CVE-2024-49853 affects the Linux kernel firmware/arm_scmi path (OPTEE transport). The issue is a double-free in the OPTEE transport where channel descriptors can be freed twice when unloading the stack, due to channels being shared between protocols. This can lead to memory corruption or potentia...

CVE-2024-49853

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack...

CVE-2024-49853 firmware: arm_scmi: Fix double free in OPTEE transport

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack...

CVE-2024-49853 firmware: arm_scmi: Fix double free in OPTEE transport

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2022-48655 firmware: arm_scmi: Harden accesses to the reset domains

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655 firmware: arm_scmi: Harden accesses to the reset domains

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2024-26893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893 firmware: arm_scmi: Fix double free in SMC transport cleanup path

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893 firmware: arm_scmi: Fix double free in SMC transport cleanup path

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26893

CVE-2024-26893 affects the Linux kernel ARM SCMI SMC transport cleanup path. The vulnerability is caused by a double-free in the chan_free cleanup of a shared transport_info member, which can dereference a NULL pointer on the second cleanup attempt, leading to a kernel crash (OOPs). The issue occ...

CVE-2023-52608

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a...

CVE-2023-52608

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a...