Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s Microchip CoreSPI driver can leave old data in hardware buffers. A later SPI operation may receive those stale bytes as if they were new, potentially corrupting data or exposing prior transfer contents. Exposure is limited to systems using the affected SPI controller and driver; it is not a general vulnerability in every Linux system.
Executive priority
Treat this as a high-priority targeted remediation for products using Microchip CoreSPI, especially where SPI data influences safety, secrets, or device control. Do not treat it as a fleet-wide Linux emergency without confirming the affected hardware and driver. Escalate ambiguous vendor version mappings for prompt confirmation.
Technical view
When a transfer has no receive buffer, the interrupt handler does not drain the RX FIFO. A subsequent transfer can copy residual bytes into the beginning of its receive buffer. The correction clears both RX and TX FIFOs before every transfer. The supplied CVSS 3.1 assessment is 7.8 with local, low-privileged access and potential confidentiality, integrity, and availability impact.
Likely exposure
Likely exposure is concentrated in embedded systems, appliances, or boards using Linux with the Microchip CoreSPI controller. The supplied affected-version data is ambiguous and includes commit identifiers alongside kernel versions, so determine exposure through hardware inventory, driver usage, vendor guidance, and comparison with the referenced stable fixes.
Exploitation context
The bundle does not establish active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates local, low-privileged access rather than remote exploitation. Practical abuse would likely require an attacker to influence affected SPI transfers; the sources do not document a public exploit or confirmed attack path.
Researcher notes
The stated failure mode is stale FIFO data crossing transfer boundaries. Security consequences depend on what the SPI bus carries and whether an attacker can initiate or shape transfers. The source bundle provides three stable-kernel corrections but no clear fixed-version table, exploit evidence, CWE assignment, or demonstrated impact scenario; avoid inferring more specific reachability.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix.
- Prioritize embedded and appliance systems that actively use the Microchip CoreSPI driver.
- Consult device or distribution vendors for corrected package versions and deployment guidance.
- Restrict untrusted local access to interfaces or services capable of initiating relevant SPI transfers.
Validation and detection
- Identify devices using the Microchip CoreSPI controller and corresponding Linux driver.
- Compare deployed kernel code or vendor packages against the referenced stable fixes.
- Verify the corrected driver clears RX and TX FIFOs before each transfer.
- After updating, test consecutive transmit-only and receive transfers for stale leading data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42279 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3feda3677e8bbe833c3a62a4091377a08f015b80CVE reference, Linux
- https://git.kernel.org/stable/c/45e03d35229b680b79dfea1103a1f2f07d0b5d75CVE reference, Linux
- https://git.kernel.org/stable/c/9cf71eb0faef4bff01df4264841b8465382d7927CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.