CVE-2021-47609

What it actually does

The vulnerability is an unbounded string copy of the SCPI device name from a device tree node into a fixed-size buffer (max 30 characters) in the arm_scpi genpd driver, enabling a classic buffer overflow.

Why it matters to the business

Memory corruption in the Linux kernel on affected ARM platforms can cause system instability, crashes, or potential escalation of privileges, disrupting device operation and requiring urgent kernel updates across fleets.

How an attack unfolds

An attacker supplies a crafted device tree node containing an overly long power-domain name string; during SCPI driver initialization the name is copied without length checks, overflowing the buffer and corrupting adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the fixed buffer with devm_kasprintf for dynamic allocation of the device name.

How to confirm the fix worked

Inspect kernel source for the arm_scpi driver change that uses devm_kasprintf instead of direct assignment; confirm the patched kernel boots without name-length crashes on SCPI platforms.

Typical attack path

1. Prepare a malicious device tree blob with a power-domain name exceeding 30 characters
2. Load or boot the kernel with the crafted device tree
3. Trigger SCPI genpd driver probe and name copy
4. Exploit resulting memory corruption for denial of service or code execution

How to detect it

Review kernel logs and dmesg for SCPI driver initialization errors or buffer-related faults; inspect loaded device trees for suspiciously long power-domain names.

What your security team should do

• Prioritize kernel upgrades on all ARM systems using SCPI firmware
• Audit device tree sources for power-domain name lengths
• Enable kernel hardening features such as stack canaries and KASAN in test environments
• Monitor for SCPI-related kernel oops or panics in production logs