CVE-2024-42279

What it actually does

The SPI driver fails to clear TX and RX FIFOs before starting a new transfer, allowing residual data from a prior transfer with zero receive length to be read into the subsequent receive buffer.

Why it matters to the business

This kernel flaw in widely used Linux systems with 303 downstream dependents can lead to unintended data leakage between SPI device communications, potentially exposing sensitive information in embedded and hardware-interfacing environments.

How an attack unfolds

An attacker with the ability to initiate SPI transfers on affected Microchip core hardware could sequence operations to cause previous FIFO contents to be misinterpreted as new data.

How to fix it

Update the Linux kernel to the fixed version including commit 3feda3677e8bbe833c3a62a4091377a08f015b80 or apply the equivalent patch that clears FIFOs before each transfer. For undici (npm) update to 5.8.2.

How to confirm the fix worked

Verify the presence of the FIFO clearing code before transfers in the microchip-core SPI driver source after applying the update.

Typical attack path

1. Identify affected SPI hardware using Microchip core driver
2. Trigger a transfer with rx_len set to zero
3. Initiate a subsequent transfer to read stale FIFO contents into the receive buffer

How to detect it

Inspect kernel logs and SPI driver traces for unexpected data patterns in receive buffers following zero-length transfers on Microchip core hardware.

What your security team should do

• Apply kernel updates containing the FIFO clear fix on all affected systems
• Audit SPI-using devices for Microchip core controllers and prioritize patching based on exposure
• Test SPI communications post-update to confirm no residual data leakage