CVE-2024-35883

What it actually does

Missing null pointer check after devm_kzalloc in pci1xxx_spi_probe allows dereference of a null spi_int array entry, resulting in kernel memory corruption.

Why it matters to the business

Affected Linux systems using Microchip PCI1xxx SPI hardware may suffer kernel crashes or instability, disrupting services and requiring reboots.

How an attack unfolds

An attacker triggers the pci1xxx_spi_probe function under low-memory conditions so that devm_kzalloc fails, then the subsequent unchecked access to spi_bus->spi_int[iter] dereferences null and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a revision containing commit 4b31a226097cf8cc3c9de5e855d97757fdb2bf06; rebuild and deploy the updated kernel package on all affected systems.

How to confirm the fix worked

Confirm the null-check for spi_bus->spi_int[iter] exists inside pci1xxx_spi_probe in the running kernel source and that the driver loads without oops under memory-pressure testing.

Typical attack path

1. Identify a host running a vulnerable kernel with the mchp-pci1xxx driver loaded
2. Induce memory pressure or device re-probe to force kzalloc failure
3. Allow the probe routine to dereference the unchecked pointer
4. Trigger kernel panic or exploitable memory corruption

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing pci1xxx_spi_probe, devm_kzalloc failures, or null dereferences in the SPI subsystem.

What your security team should do

• Prioritize kernel updates on all systems exposing the mchp-pci1xxx driver
• Add the fixed commit hash to patch-management automation
• Include SPI-probe paths in kernel crash monitoring and alerting