CVE-2024-42092

What it actually does

Out-of-bounds access in davinci_gpio_probe() when pdata->gpio_unbanked from Device Tree exceeds the maximum IRQs per bank, allowing invalid array indexing in the Linux kernel GPIO driver.

Why it matters to the business

Systems using affected Linux kernel versions with Davinci GPIO hardware may experience crashes or instability during device initialization, especially if relying on Device Tree configuration; widespread kernel updates needed across servers and embedded devices.

How an attack unfolds

An attacker supplies a malformed Device Tree blob that sets an excessively large gpio_unbanked value; during kernel boot or module load the davinci_gpio_probe function performs an unchecked array access leading to memory corruption.

How to fix it

Update the Linux kernel to a version containing commit a8d78984fdc105bc1a38b73e98d32b1bc4222684 which adds validation of the nirq value against the maximum IRQs per bank.

How to confirm the fix worked

Inspect kernel source or running version for the added bounds check on pdata->gpio_unbanked in davinci_gpio.c; test probe with both valid and invalid Device Tree values.

Typical attack path

1. Craft a malicious Device Tree with invalid gpio_unbanked value
2. Load or boot the Linux kernel on affected hardware
3. Trigger davinci_gpio_probe during GPIO initialization
4. Cause out-of-bounds memory access

How to detect it

Review kernel logs and dmesg for oops or panic messages referencing davinci_gpio_probe or gpio_unbanked; examine boot logs for Device Tree parsing anomalies on systems using the davinci GPIO driver.

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on all Davinci-based systems
• Audit Device Tree sources for correctness before deployment
• Monitor for kernel oops reports during boot on affected hardware