CVE-2024-42279

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable `mchp_corespi_transfer_one()` path is entered from the SPI core, reachable locally through spidev ioctls (`SPI_IOC_MESSAGE`) or by driving any in-kernel SPI client; no network or physical access to the board is needed.

AC:LAttack complexity, low

The attacker can reliably dirty the RX FIFO with back-to-back transfers (including transfers larger than the 32-byte FIFO that provoke `INT_RX_CHANNEL_OVERFLOW`, or aborted transfers), and the residue is sticky rather than probabilistic, so no condition outside the attacker's control is required.

PR:LPrivileges required, low

Only ordinary local access to an SPI device node (commonly group-accessible on embedded platforms) or the ability to trigger an SPI client is needed; there is no capability check anywhere on the path from the ioctl to `transfer_one`.

UI:NUser interaction, none

The attacker issues the transfers themselves and the stale-FIFO condition persists on its own; no victim action is required.

S:UScope, unchanged

The impact stays within the kernel and the SPI controller managed by it; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Bytes clocked in during a previous transaction — from any device on the shared bus, including a TPM, secure element, or the boot/root SPI flash — are copied into the attacker's RX buffer, and the leak can be repeated indefinitely, so security-critical data transiting the bus can be siphoned across driver and process boundaries.

I:HIntegrity impact, high

Residue from the attacker's own transaction is prepended into the next client's `rx_buf`, and an attacker transacting with a readback-capable slave controls those bytes exactly, allowing chosen data to be injected into another driver's input — e.g. corrupting a secure-element/TPM response or data read from the root flash.

A:HAvailability impact, high

The residue count never clears, so once the FIFO fills every subsequent transfer overflows and returns garbage, permanently breaking every device on the controller (rootfs SPI-NOR, watchdog, sensors) until reboot, with SPI core transfer timeouts and `dev_err` spam.