CVE-2023-54295

What it actually does

Out-of-bounds shift operation in spi_nor_set_erase_type when masking erase types with zero size, causing UBSAN-detected shift exponent 4294967295 on 32-bit int and potential memory corruption.

Why it matters to the business

May trigger kernel crashes or undefined behavior on systems using SPI-NOR flash storage under specific erase-type masking conditions; low exploitation likelihood reduces immediate operational risk but still requires patching for stability.

How an attack unfolds

An attacker with local access or ability to trigger SPI-NOR erase operations supplies parameters that invoke masking of an erase type with zero size, hitting the erroneous shift; the original code set opcode to 0xFF which was also unsafe.

How to fix it

Update the Linux kernel to a version containing commit e6409208c13f7c56adc12dd795abf4141e3d5e64 which sets erase size to zero when masking instead of performing the shift.

How to confirm the fix worked

Verify the applied kernel source contains e6409208c13f7c56adc12dd795abf4141e3d5e64 and confirm absence of the UBSAN shift error when exercising spi-nor erase masking paths.

Typical attack path

1. Gain local execution context on affected Linux kernel
2. Trigger code paths exercising spi_nor_set_erase_type for erase-type masking
3. Supply erase size of zero to induce shift-out-of-bounds
4. Observe kernel panic or attempt to leverage resulting memory corruption

How to detect it

Review kernel logs for UBSAN shift-out-of-bounds messages referencing drivers/mtd/spi-nor/core.c:2237 and inspect MTD/spi-nor erase-type configuration calls.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using spi-nor
• Monitor for any local privilege-escalation attempts involving MTD devices
• Test SPI-NOR flash operations in staging environments before production rollout