🇰🇷 한글 설명
Linux 커널의 s32cc pinctrl 드라이버에서 s32_pinctrl_desc 구조체가 초기화되지 않은 상태로 할당되는 취약점이 발견되었습니다. 이로 인해 num_custom_params 필드에 쓰레기 값이 포함되어 메모리 할당 오류 및 종속된 드라이버의 설정 실패를 유발할 수 있습니다.
💡 쉬운 설명
컴퓨터 부품을 제어하는 설정 파일에 쓰레기 데이터가 섞여 들어가 시스템이 오작동하거나 특정 장치를 제대로 인식하지 못하는 문제입니다. 메모리를 깨끗하게 비우지 않고 사용하여 발생하는 오류입니다.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its
fields are initialized. Notably, num_custom_params is used in
pinconf_generic_parse_dt_config(), resulting in intermittent allocation
errors, such as the following splat when probing i2c-imx:
WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300
[...]
Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT)
[...]
Call trace:
__alloc_pages_noprof+0x290/0x300 (P)
___kmalloc_large_node+0x84/0x168
__kmalloc_large_node_noprof+0x34/0x120
__kmalloc_noprof+0x2ac/0x378
pinconf_generic_parse_dt_config+0x68/0x1a0
s32_dt_node_to_map+0x104/0x248
dt_to_map_one_config+0x154/0x1d8
pinctrl_dt_to_map+0x12c/0x280
create_pinctrl+0x6c/0x270
pinctrl_get+0xc0/0x170
devm_pinctrl_get+0x50/0xa0
pinctrl_bind_pins+0x60/0x2a0
really_probe+0x60/0x3a0
[...]
__platform_driver_register+0x2c/0x40
i2c_adap_imx_init+0x28/0xff8 [i2c_imx]
[...]
This results in later parse failures that can cause issues in dependent
drivers:
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property
[...]
pca953x 0-0022: failed writing register: -6
i2c i2c-0: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property
i2c i2c-1: IMX I2C adapter registered
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property
i2c i2c-2: IMX I2C adapter registered
Fix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of
devm_kmalloc() in s32_pinctrl_probe(), which sets the previously
uninitialized fields to zero.
📍 영향받는 시스템
Linux kernel (pinctrl: s32cc driver used in NXP S32G3 platforms)
⚔️ 공격 벡터
Local/Physical (Uninitialized memory can lead to unpredictable kernel behavior or DoS)
🛡️ 대응 방법
s32_pinctrl_probe() 함수 내에서 devm_kmalloc()을 devm_kzalloc()으로 변경하여 메모리를 0으로 초기화해야 합니다.
🔧 검증 코드
커널 버전을 확인하여 해당 취약점이 수정된 패치가 적용된 최신 커널인지 확인합니다.