bartoszek/zephyr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

doc: security: Disclose CVE-2024-11263

Browse Source 
Disclose information about published CVE

Signed-off-by: Flavio Ceolin <flavio.ceolin@gmail.com>
This commit is contained in:
Flavio Ceolin 2024-11-15 09:26:48 -08:00 committed by Mahesh Mahadevan
parent 275f44730e
commit 7aa7e894bc
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
doc/security/vulnerabilities.rst
View File

@ -1794,3 +1794,22 @@ Under embargo until 2024-11-22
-----------------
Under embargo until 2025-01-23
:cve:`2024-11263`
-----------------
arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
A rogue thread can corrupt the gp reg and cause the entire system to hard fault at best, at worst,
it can potentially trick the system to access another set of random global symbols.
- `Zephyr project bug tracker GHSA-jjf3-7x72-pqm9
<https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jjf3-7x72-pqm9>`_
This has been fixed in main for v4.0.0
- `PR 81155 fix for main
<https://github.com/zephyrproject-rtos/zephyr/pull/81155>`_
- `PR 81370 fix for 3.7
<https://github.com/zephyrproject-rtos/zephyr/pull/81370>`_