Listen to this Post
How the mentioned CVE works:
The vulnerability is in the `spi-microchip-core-qspi` driver of the Linux kernel. A code change intended to allow per-operation SPI frequency checks introduced a logic error in the driver’s `supports_op` callback function. This function is called during the initialization (probe) of an attached SPI memory device. The problem occurs because the `op->max_freq` parameter is not valid or is zero at this early stage. The code attempts to calculate a baud rate value using division based on this zero frequency, resulting in a division-by-zero operation. This causes the calculated `baud_rate_val` to become a maximum integer value (INT_MAX). The invalid calculation leads the `supports_op` function to incorrectly determine the hardware does not support the operation, causing the probe of the memory device to fail completely. This results in a local denial of service, as the SPI memory device becomes unavailable to the system.
Platform: Linux Kernel
Version: With driver
Vulnerability: Division by zero
Severity: Medium
date: 2025-10-01
Prediction: 2025-09-24
What Undercode Say:
Check if the affected module is loaded
lsmod | grep spi_microchip_core_qspi
Check kernel version and build info
uname -r
cat /boot/config-$(uname -r) | grep SPI_MICROCHIP_CORE_QSPI
View module information
modinfo spi-microchip-core-qspi
Vulnerable code snippet concept (supports_op callback)
static bool mchp_coreqspi_supports_op(...)
{
...
/ op->max_freq is 0 during probe /
baud_rate_val = DIV_ROUND_UP(clk_get_rate(qspi->clk), op->max_freq); // Division by zero
...
}
How Exploit:
A local attacker could potentially trigger this flaw during device probe, causing a denial of service for the SPI memory device. Exploitation requires access to initialize or trigger re-initialization of the affected SPI controller hardware.
Protection from this CVE:
Update the Linux kernel to a version containing the fix. The patch removes the faulty frequency check from the `supports_op` callback function.
Impact:
Denial of service preventing the use of SPI memory devices connected to the Microchip CoreQSPI controller. Impact is limited to systems using this specific hardware.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
