Executive brief
The Linux kernel's Freescale UPM NAND flash memory driver contains a boundary check error in its operation handler. This allows an attacker with local access to trigger an out-of-bounds memory access, potentially leading to information disclosure, memory corruption, or denial of service on systems using this driver.
Technical details
The vulnerability is an off-by-one error in the fun_exec_op() function of the fsl_upm NAND driver (drivers/mtd/nand/raw/fsl_upm.c). The chip select (op->cs) parameter is validated with the check `if (op->cs > NAND_MAX_CHIPS)`, but should use `>=` instead. Since op->cs is used as an array index for mchip_offsets and rnb_gpio arrays which have NAND_MAX_CHIPS elements, allowing the value to equal NAND_MAX_CHIPS results in an out-of-bounds array access. This requires local code execution or privileged access to invoke the vulnerable NAND operation handler. The fix changes the comparison from `>` to `>=` to properly reject the boundary case.
Affected products
- Linux Linux Kernel Versions with fsl_upm NAND driver (introduced in commit 54309d657767, fixed upstream)
Timeline
- 2025-12-24: disclosed
- 2023-07-19: patched: Upstream fix committed; stable backports followed