CVE-2024-36965

What it actually does

The driver reads an IPI buffer location from loaded firmware without verifying it fits inside the L2TCM SRAM size declared in devicetree; out-of-bounds R/W operations then occur on SCP boot, resulting in kernel panic at best.

Why it matters to the business

Systems using MediaTek SCP firmware may experience sudden crashes or boot failures, interrupting workloads on affected Linux devices and requiring emergency patching or rollback.

How an attack unfolds

An attacker with the ability to supply firmware to the System Companion Processor crafts an image whose IPI buffer address lies outside the L2TCM region; when the kernel remoteproc driver loads and starts the SCP, the missing size check causes memory accesses beyond the SRAM boundary and triggers a panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 00548ac6b14428719c970ef90adae2b3b48c0cdf; for Debian systems also install the corrected gtkwave packages (3.3.118-0.1~deb12u1, 3.3.118-0.1, or 3.3.104+really3.3.118-0+deb11u1 as appropriate for the release).

How to confirm the fix worked

Confirm the running kernel contains the listed commit or package version; attempt to load firmware that would previously have produced an oversized IPI buffer and verify the driver now refuses to boot the SCP instead of panicking.

Typical attack path

1. Obtain local or supply-chain access to provide firmware for the MediaTek SCP
2. Prepare firmware containing an IPI buffer address that exceeds the L2TCM size
3. Trigger loading and boot of the SCP core via the mediatek remoteproc driver
4. Driver performs unchecked R/W on the out-of-bounds IPI buffer, causing kernel panic

How to detect it

Search kernel logs for remoteproc or mediatek messages indicating IPI buffer placement failures or out-of-bounds accesses during SCP boot; correlate with attempts to load untrusted firmware images.

What your security team should do

• Prioritize kernel upgrades on all systems that load MediaTek SCP firmware
• Audit firmware supply chains to ensure only trusted images reach the driver
• Monitor kernel logs for remoteproc/mediatek errors during SCP initialization