CVE-2021-46965

What it actually does

Incorrect pointer arithmetic on a u32 variable instead of byte-granular char* causes out-of-bounds stack access in the physmap-bt1-rom MTD driver.

Why it matters to the business

Embedded Linux devices using the affected BT1 ROM mapping code face risk of kernel instability or memory corruption, potentially requiring unplanned reboots or device replacement in field deployments.

How an attack unfolds

An attacker supplies input that reaches the physmap-bt1-rom initialization path; the uncast pointer increment skips intended byte offsets and reads or writes outside the intended stack frame, enabling local memory corruption.

How to fix it

Apply the upstream kernel commit that casts &data to (char *) before pointer arithmetic; rebuild and deploy the corrected kernel image on all affected embedded platforms.

How to confirm the fix worked

Confirm the source contains the (char *) cast around &data, recompile, and run static analysis (Coverity or equivalent) to verify absence of the out-of-bounds warning; test MTD initialization on target hardware.

Typical attack path

1. Obtain local or adjacent access to a system loading the physmap-bt1-rom driver
2. Trigger MTD device registration with the vulnerable mapping routine
3. Supply data that exercises the &data increment loop
4. Cause out-of-bounds read/write on the stack

How to detect it

Review kernel logs and crash dumps for stack trace entries mentioning physmap-bt1-rom or Coverity ID 1497765; examine MTD initialization paths in custom kernels for the missing cast.

What your security team should do

• Identify all kernels built before the referenced fix and schedule replacement
• Prioritize updates for any internet-exposed or multi-tenant embedded systems
• Add the driver to static-analysis pipelines to catch similar pointer-type errors