Messages in this thread | | | Subject | Re: CVE-2024-26827: i2c: qcom-geni: Correct I2C TRE sequence | From | Jean Delvare <> | Date | Thu, 18 Apr 2024 14:56:33 +0200 |
| |
Hi Greg,
On Wed, 2024-04-17 at 11:44 +0200, Greg Kroah-Hartman wrote: > Description > =========== > > In the Linux kernel, the following vulnerability has been resolved: > > i2c: qcom-geni: Correct I2C TRE sequence > > For i2c read operation in GSI mode, we are getting timeout > due to malformed TRE basically incorrect TRE sequence > in gpi(drivers/dma/qcom/gpi.c) driver. > (...)
I was assigned the task to backport this security fix to the SUSE kernels. However, from the description, I fail to see how this fix qualifies as a security fix. I can't find the reason why a CVE was assigned to the issue.
What is the considered attack vector? Or if there is no attack vector, what consequence does this bug have, which would put the system security at stake?
From my perspective, all we have here is a functional bug in newly introduced code. It's not even a regression.
-- Jean Delvare SUSE L3 Support
| |