CVE-2023-54295

Vulnerability

Overview

CVE-2023-54295 is a shift-out-of-bounds vulnerability in the Linux kernel's SPI NOR flash driver, specifically in the spi_nor_set_erase_type() function. The function was used both to set or to mask out an erase type. When masking out an erase type, the erase size was zero but the code still attempted to compute the size shift and mask using the value, leading to an undefined behavior detected by UBSAN as a shift exponent of 4294967295 (0xFFFFFFFF) for a 32-bit integer shift.

Exploitation

The vulnerability can be triggered by any operation that causes the driver to mask out an erase type, such as when parsing a flash device's parameters or handling an unsupported erase command. No authentication is required beyond having local access to the system or the ability to interact with the SPI NOR device, typically through a kernel interface or by physically connecting a malicious flash chip. The bug is reachable from user space via control of flash partitions or configuration, though the affected code path is exercised during device initialization or reconfiguration.

Impact

An attacker able to trigger this bug causes an undefined behavior due to a shift-out-of-bounds, which may lead to a kernel crash (denial of service) or potentially corrupt memory and enable privilege escalation. The impact is limited to systems with SPI NOR flash devices, but the bug can be exploited without needing any special privileges beyond the ability to mount or configure MTD partitions.

Mitigation

The fix was applied in the Linux kernel stable commit [1] and [2], which changes the behavior so that when an erase type is disabled (size zero), the size_shift, size_mask, and opcode are no longer set unnecessarily. This avoids any arithmetic on zero-sized erase types. Users should update to a kernel version containing these commits or apply the patch to their kernel source.