CVE-2020-36787: 
Linux Debian vulnerability analysis and mitigation

A clock handling logic flaw was discovered in the Linux kernel's Aspeed Video Engine driver. The vulnerability (CVE-2020-36787) affects the clock enabling sequence of the video engine, which uses eclk and vclk for its clock sources. The issue was found in the improper reset sequence that could lead to unexpected DMA memory transfers (Red Hat CVE, Kernel Commit).

The vulnerability stems from an improper clock enabling sequence where eclk is enabled first, followed by Video Engine reset de-assertion, a 10ms delay, and then vclk enablement. This sequence introduces an improper reset on the Video Engine hardware. The issue is particularly observed on specific AST2500 SoCs, though rarely, and can occur even when the video engine is not actively used, as udevd activates the video engine hardware briefly during boot for queries (Kernel Commit).

The vulnerability can cause the hardware to generate unexpected DMA memory transfers that can corrupt memory regions in random and sporadic patterns. This can lead to critical kernel panics with various signatures, making the issue extremely difficult to debug (Red Hat CVE, Kernel Commit).

The vulnerability has a moderate severity rating with a CVSS v3 score of 6.0. While the vulnerability requires local access and high privileges to exploit, it can potentially lead to high confidentiality and availability impacts (Red Hat CVE).

The issue has been fixed by changing the clock handling logic to ensure the reset de-assertion is triggered after enabling both eclk and vclk. Additionally, clk_unprepare call has been added for cases when probe fails. Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability (Red Hat CVE, Kernel Commit).