{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-52871",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-52871"
  ],
  "published": "2024-05-21T15:34:20Z",
  "summary": "soc: qcom: llcc: Handle a second device without data corruption",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: llcc: Handle a second device without data corruption\n\nUsually there is only one llcc device. But if there were a second, even\na failed probe call would modify the global drv_data pointer. So check\nif drv_data is valid before overwriting it.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.63",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52871"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cc1a1dcb411fe224f48553cfdcdfe6e61395b69c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5e5b85ea0f4bc484bfe4cc73ead51fa48d2366a0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/995ee1e84e8db7fa5dcdde7dfe0bd7bb6f9bbb8c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f0ef883cae309bc5e8cdfcdbc1b4822732ce20a8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3565684309e54fa998ea27f37028d67cc3e1dff2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1143bfb9b055897975aeaea254da148e19524493"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f1a1bc8775b26345aba2be278118999e7f661d3d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is qcom_llcc_probe in the Qualcomm LLCC platform driver, reached only via device-tree platform device probe or local sysfs driver bind\u2014not via network packets or remote protocols.\nAC:L - Once a second matching LLCC platform device is instantiated, probe unconditionally overwrites the global drv_data pointer and the failure path sets ERR_PTR(-ENODEV), so corruption is deterministic with no race or luck required.\nPR:L - Exploitation requires local ability to cause a second matching platform device to probe (crafted DT/overlay or driver bind on Qualcomm platforms); this is scored as low privileges under the higher-severity rule rather than requiring fully privileged root-only admin.\nUI:N - No victim interaction is needed; the corruption occurs entirely during kernel probe of the second device and can fault when existing in-kernel clients use LLCC.\nS:U - Impact stays within the host kernel\u2019s security authority (driver state and system-cache configuration); there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug overwrites a global driver pointer and can cause crashes or wrong MMIO programming, but it does not provide an information-disclosure or memory-read primitive.\nI:H - A second probe reliably corrupts the global drv_data used for all LLCC operations and can reprogram system-cache slice configuration registers, which is high-integrity impact as described in the fix (\u201cdata corruption\u201d).\nA:H - While the global points at a zeroed allocation mid-probe, clients such as a6xx_llc_activate call llcc_slice_activate and dereference NULL bcast_regmap/bitmap, causing a kernel oops/panic."
    }
  }
}