CVE-2024-42092: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42092 affects the Linux kernel's GPIO Davinci driver. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using SVACE static analysis tool. The issue stems from insufficient validation of the gpio_unbanked value obtained from the Device Tree, which could lead to out-of-bounds array access in the davinci_gpio_probe() function (NVD).

The vulnerability exists in the GPIO Davinci driver where the value of pdata->gpio_unbanked is taken from the Device Tree without proper validation. In case of a broken Device Tree configuration, this value could be arbitrary, potentially leading to out-of-bounds access of the chips->irqs array in the davinci_gpio_probe() function. The fix involves adding validation to ensure the obtained nirq value won't exceed the maximum number of IRQs per bank (Kernel Commit).

If exploited, this vulnerability could allow an attacker to cause a buffer overflow through out-of-bounds array access, potentially leading to system crashes or other undefined behavior when interacting with the GPIO Davinci driver (NVD).

The vulnerability requires a broken or malformed Device Tree configuration to be exploited. It affects systems using the Davinci GPIO driver in the Linux kernel. No known exploits in the wild have been reported (NVD).

The vulnerability has been patched in various Linux kernel versions. The fix involves adding a validation check to ensure the nirq value doesn't exceed MAX_INT_PER_BANK. Users should update their kernel to a version containing the fix. The patch has been backported to multiple stable kernel branches (Kernel Commit).