high 7.8

CVE-2024-46853 json

spi: nxp-fspi: fix the KASAN report out-of-bounds bug

published 2024-09-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-42114

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO.

To reproduce the issue, write 3 bytes data to NOR chip.

dd if=3b of=/dev/mtd0 [ 36.926103] ================================================================== [ 36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838 [ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455 [ 36.946721] [ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070 [ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT) [ 36.961260] Call trace: [ 36.963723] dump_backtrace+0x90/0xe8 [ 36.967414] show_stack+0x18/0x24 [ 36.970749] dump_stack_lvl+0x78/0x90 [ 36.974451] print_report+0x114/0x5cc [ 36.978151] kasan_report+0xa4/0xf0 [ 36.981670] __asan_report_load_n_noabort+0x1c/0x28 [ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838 [ 36.990800] spi_mem_exec_op+0x8ec/0xd30 [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0 [ 36.999323] spi_mem_dirmap_write+0x238/0x32c [ 37.003710] spi_nor_write_data+0x220/0x374 [ 37.007932] spi_nor_write+0x110/0x2e8 [ 37.011711] mtd_write_oob_std+0x154/0x1f0 [ 37.015838] mtd_write_oob+0x104/0x1d0 [ 37.019617] mtd_write+0xb8/0x12c [ 37.022953] mtdchar_write+0x224/0x47c [ 37.026732] vfs_write+0x1e4/0x8c8 [ 37.030163] ksys_write+0xec/0x1d0 [ 37.033586] __arm64_sys_write+0x6c/0x9c [ 37.037539] invoke_syscall+0x6c/0x258 [ 37.041327] el0_svc_common.constprop.0+0x160/0x22c [ 37.046244] do_el0_svc+0x44/0x5c [ 37.049589] el0_svc+0x38/0x78 [ 37.052681] el0t_64_sync_handler+0x13c/0x158 [ 37.057077] el0t_64_sync+0x190/0x194 [ 37.060775] [ 37.062274] Allocated by task 455: [ 37.065701] kasan_save_stack+0x2c/0x54 [ 37.069570] kasan_save_track+0x20/0x3c [ 37.073438] kasan_save_alloc_info+0x40/0x54 [ 37.077736] __kasan_kmalloc+0xa0/0xb8 [ 37.081515] __kmalloc_noprof+0x158/0x2f8 [ 37.085563] mtd_kmalloc_up_to+0x120/0x154 [ 37.089690] mtdchar_write+0x130/0x47c [ 37.093469] vfs_write+0x1e4/0x8c8 [ 37.096901] ksys_write+0xec/0x1d0 [ 37.100332] __arm64_sys_write+0x6c/0x9c [ 37.104287] invoke_syscall+0x6c/0x258 [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c [ 37.112972] do_el0_svc+0x44/0x5c [ 37.116319] el0_svc+0x38/0x78 [ 37.119401] el0t_64_sync_handler+0x13c/0x158 [ 37.123788] el0t_64_sync+0x190/0x194 [ 37.127474] [ 37.128977] The buggy address belongs to the object at ffff00081037c2a0 [ 37.128977] which belongs to the cache kmalloc-8 of size 8 [ 37.141177] The buggy address is located 0 bytes inside of [ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3) [ 37.153465] [ 37.154971] The buggy address belongs to the physical page: [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c [ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.175149] page_type: 0xfdffffff(slab) [ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000 [ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000 [ 37.194553] page dumped because: kasan: bad access detected [ 37.200144] [ 37.201647] Memory state around the buggy address: [ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc [ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc [ 37.228186] ^ [ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.246962] ============================================================== ---truncated---

Patch / fix

fixed in 1 distros 5 links 7

Linux Linux 5.4.285, 5.10.227, 5.15.168, 6.1.111, 6.6.52, 6.10.11, 6.11

debian ubuntu red hat suse azure linux

linux Debian 12 6.1.112-1
linux Debian 14, Debian 13 6.10.11-1

debian advisories DEBIAN-CVE-2024-46853

linux Ubuntu 20.04 LTS 5.4.0-208.228
linux Ubuntu 22.04 LTS 5.15.0-127.137
linux Ubuntu 24.04 LTS 6.8.0-50.51
linux-aws Ubuntu 20.04 LTS 5.4.0-1140.150
linux-aws Ubuntu 22.04 LTS 5.15.0-1073.79
linux-aws Ubuntu 24.04 LTS 6.8.0-1020.22
linux-gcp Ubuntu 20.04 LTS 5.4.0-1143.152
linux-gcp Ubuntu 22.04 LTS 5.15.0-1072.80

ubuntu advisories UBUNTU-CVE-2024-46853

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-570.12.1.el9_6
rv RHEL 9 5.14.0-570.12.1.el9_6
perf RHEL 9 5.14.0-570.12.1.el9_6
rtla RHEL 9 5.14.0-570.12.1.el9_6
libperf RHEL 9 5.14.0-570.12.1.el9_6
kernel-rt RHEL 9 5.14.0-570.12.1.el9_6
kernel-64k RHEL 9 5.14.0-570.12.1.el9_6
kernel-core RHEL 9 5.14.0-570.12.1.el9_6

red hat advisories RHSA-2025:6966

kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1.21.4
kernel-livepatch-MICRO-6-0_Update_4 Linux Micro 6.1, Linux Micro 6.0 1-1.2
kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-22.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-22.1
kernel-livepatch-MICRO-6-0-RT_Update_4 Linux Micro 6.1, Linux Micro 6.0 1-1.1

suse advisories SUSE-SU-2025:20164-1 SUSE-SU-2025:20247-1 SUSE-SU-2025:20163-1 SUSE-SU-2025:20246-1 SUSE-SU-2024:4387-1 SUSE-SU-2024:4376-1

kernel Azure Linux 3.0 6.6.56.1-5
kernel CBL-Mariner 2.0 5.15.176.3-1

azure linux advisories AZL-49945 AZL-49983

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-46853 updated 2026-11-05 cvss 6.7

kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug

Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.12.1.el9_6, perf 5.14.0-570.12.1.el9_6, rtla 5.14.0-570.12.1.el9_6, python3-perf 5.14.0-570.12.1.el9_6, kernel-devel-matched 5.14.0-570.12.1.el9_6, kernel-64k-devel-matched 5.14.0-570.12.1.el9_6, +7 more Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.12.1.el9_6, kernel-64k 5.14.0-570.12.1.el9_6, kernel-core 5.14.0-570.12.1.el9_6, kernel-tools 5.14.0-570.12.1.el9_6, kernel-modules 5.14.0-570.12.1.el9_6, kernel-64k-core 5.14.0-570.12.1.el9_6, +27 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.12.1.el9_6 Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-64k 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-64k-core 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-kvm 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +6 more
fixed: vendor fix RHSA-2025:6966
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-29)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-787 Out-of-bounds Write

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /stable/c/aa05db44db5f409f6d91c27b5737efb49fb45d9f
patch
git.kernel.org /stable/c/609260542cf86b459c57618b8cdec8020394b7ad
patch
git.kernel.org /stable/c/491f9646f7ac31af5fca71be1a3e5eb8aa7663ad
patch
git.kernel.org /stable/c/09af8b0ba70072be831f3ec459f4063d570f9e24
patch
git.kernel.org /stable/c/af9ca9ca3e44f48b2a191e100d452fbf850c3d87
patch
git.kernel.org /stable/c/d1a1dfcec77c57b1181da93d11a3db1bc4eefa97
patch
git.kernel.org /stable/c/2a8787c1cdc7be24fdd8953ecd1a8743a1006235
patch
lists.debian.org /debian-lts-announce/2025/03/msg00002.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2025/01/msg00001.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2024-46853
NVD CVE-2024-46853

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary