漏洞标题
固件：arm_scmi：检查邮箱/SMC通道的一致性。
漏洞描述信息
在Linux内核中，已经解决了以下漏洞：
firmware: arm_scmi: 检查邮箱/多线程通道的一致性
当接收完成中断时，会访问共享内存区域，首先检索消息头，然后如果消息序列号标识的交易仍然悬而未决，还会获取相关负载。
如果SCMI命令超时，通道所有权仍保留在平台，最终可能会收到迟到的回复。结果是，任何进一步的传输尝试都将保持待定状态，等待平台释放通道。
一旦收到迟到的回复，通道所有权将返回给代理，然后任何待定请求将被允许继续进行，并覆盖刚刚送达迟到回复的SMT区域；接着，等待新请求回复的周期开始。
观察到与迟到回复相关的误中断可能会错误地关联到刚加入队列的新请求。当这种情况发生时，SCMI栈中的在途查找过程会被误导，因为现在存在于SMT区域的消息头与新的待定交易相关，尽管真正的回复还未到来。
这种A2P通道上的竞态条件可以通过查看通道状态位来检测：来自平台的真正回复会在触发完成中断之前设置通道自由位。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
未加控制的资源消耗(资源穷尽)
漏洞标题
firmware: arm_scmi: Check mailbox/SMT channel for consistency
漏洞描述信息
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Check mailbox/SMT channel for consistency
On reception of a completion interrupt the shared memory area is accessed
to retrieve the message header at first and then, if the message sequence
number identifies a transaction which is still pending, the related
payload is fetched too.
When an SCMI command times out the channel ownership remains with the
platform until eventually a late reply is received and, as a consequence,
any further transmission attempt remains pending, waiting for the channel
to be relinquished by the platform.
Once that late reply is received the channel ownership is given back
to the agent and any pending request is then allowed to proceed and
overwrite the SMT area of the just delivered late reply; then the wait
for the reply to the new request starts.
It has been observed that the spurious IRQ related to the late reply can
be wrongly associated with the freshly enqueued request: when that happens
the SCMI stack in-flight lookup procedure is fooled by the fact that the
message header now present in the SMT area is related to the new pending
transaction, even though the real reply has still to arrive.
This race-condition on the A2P channel can be detected by looking at the
channel status bits: a genuine reply from the platform will have set the
channel free bit before triggering the completion IRQ.
Add a consistency check to validate such condition in the A2P ISR.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Linux kernel 安全漏洞
漏洞描述信息
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm_scmi存在安全漏洞。
CVSS信息
N/A
漏洞类别
其他