CVE-2021-47282

What it actually does

Out-of-bounds write to a statically sized per-slave register cache array inside the bcm2835 SPI controller driver when device-tree GPIO chipselects exceed the compile-time limit of three native chipselects.

Why it matters to the business

Kernel memory corruption on Raspberry Pi and other bcm2835-based systems can cause crashes, denial of service, or potential local privilege escalation when many SPI devices are attached via GPIO chipselect lines.

How an attack unfolds

An attacker with the ability to supply or modify device-tree overlays adds four or more SPI slaves that use GPIO chipselects; of_spi_get_gpio_numbers() silently increases num_chipselect, allowing spi_add_device() and subsequent prepare_message paths to index past the end of the prepare_cs[] array.

How to fix it

Upgrade the Linux kernel to a version containing commit 571e31fa60b3 and the follow-on fix that raises the slave limit to 24 while enforcing the native-chipselect cap; apply the exact fixed package versions listed for each distribution.

How to confirm the fix worked

Verify the running kernel contains the fix by checking for the presence of the updated num_chipselect handling and the 24-slave compile-time array size; confirm device-tree validation now rejects excess native chipselects at setup time.

Typical attack path

1. Supply malicious device-tree overlay or DTB that declares >3 SPI slaves using GPIO chipselects
2. Load the bcm2835-spi driver during boot or module insertion
3. Trigger spi_add_device() or message preparation for any of the extra slaves
4. Perform out-of-bounds read/write on the prepare_cs[] array leading to memory corruption

How to detect it

Inspect kernel logs for bcm2835-spi driver oops or KASAN reports referencing prepare_cs[] array accesses; look for device-tree blobs containing more than three spi device nodes with gpio-cs properties.

What your security team should do

• Apply the kernel updates for all affected distributions immediately
• Audit device trees for SPI devices using more than three GPIO chipselects
• Monitor EPSS and any new exploit code despite current low scores
• Restrict unprivileged users from loading arbitrary device-tree overlays