OF: Fix Out-of-Bounds Read in Linux Kernel of_alias_scan()

Executive Summary

This vulnerability is in the Linux kernel's device tree (of) handling. It involves an out-of-bounds read in the of_alias_scan() function's stem parser. The parser checks if a character is a digit before verifying if the string has valid bounds, causing it to read one byte before the property name when the name is empty or consists only of digits.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's device tree parsing. Detection requires checking the kernel version and examining the of_alias_scan() function in the kernel source. No direct network detection commands exist. Review kernel logs for parsing errors or system crashes related to device tree processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data or cause system instability by triggering an out-of-bounds read. It may lead to crashes, information leaks, or privilege escalation if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel bug with no documented impact on data protection, privacy, or security frameworks.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. If immediate patching is not possible, avoid using device tree configurations with empty or all-digit property names to reduce exposure. Monitor system logs for related errors.

Useful 0 Not Useful 0