CVE-2023-52517

What it actually does

Race condition in the sun6i SPI driver allows concurrent access to the RX FIFO by the DMA engine and the transfer-complete IRQ handler drain procedure in DMA mode, while the RX buffer pointer is never updated based on DMA progress, resulting in corrupted data in the receive buffer.

Why it matters to the business

Systems relying on SPI DMA transfers may experience silent data corruption or application failures when communicating with attached hardware, increasing operational risk and potential downtime on affected Linux kernels.

How an attack unfolds

An attacker with local access or the ability to influence SPI traffic triggers DMA-mode transfers and times the completion interrupt to race against the DMA engine, corrupting RX data; no public exploits or threat actor usage reported.

How to fix it

Update the Linux kernel to a version containing commit bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f, which restricts RX FIFO draining to interrupt mode only and waits for DMA completion before returning.

How to confirm the fix worked

Inspect the spi-sun6i driver source for the updated DMA RX handling logic; confirm via kernel build or runtime tests that RX FIFO drain occurs exclusively in interrupt mode and DMA completion is awaited.

Typical attack path

1. Gain local execution or control over SPI client traffic on an affected kernel
2. Configure or trigger SPI transfers in DMA mode
3. Force timing window between transfer-complete IRQ and DMA FIFO drain
4. Observe or leverage resulting RX buffer corruption

How to detect it

Search kernel logs and SPI driver traces for unexpected RX buffer contents, transfer completion anomalies, or corruption indicators on systems employing the sun6i SPI controller in DMA mode.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using sun6i SPI in DMA mode
• Review SPI driver usage and disable DMA mode where feasible until patched
• Monitor kernel changelogs for related sun6i SPI fixes in stable branches