atmel-sha204a I2C failure heap info leak analysis & fix

Vulnerability Summary: Heap Information Leak in atmel-sha204a on I2C Transfer Failure Vulnerability Overview Vulnerability Type: Heap information leak Affected Driver: Trigger Condition: The completion callback is invoked with a non-zero status when an underlying I2C transfer fails. Root Cause: - The non-blocking RNG allocated a work data pointer to track in-flight asynchronous I2C requests stored in . - The legacy code merely logged a warning upon transfer failure but failed to release the pointer, leaving the pointer state uncleared. - Subsequent reads may misinterpret the residual state as valid completion data, resulting in a heap information leak. Scope of Impact Affected File: Affected Function: Affected Scenario: State handling after an I2C transaction failure Fix Description Fix Method: Release the pending work data in subsequent invocations (freeing the pending work data). Fix Logic: - Ensure that failed requests do not leave residual state, preventing it from being misread as valid RNG data. - Set to NULL in subsequent invocations to clear the state. POC / Fix Code (diff extraction) ```c @@ -31,10 +31,14 @@ static void atmel_sha204a_rng_do_read(struct atmel_i2c_work_data work_data, struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv = work_data->ctx; struct atmel_i2c_client_priv i2c_priv

Goal Reached Thanks to every supporter — we hit 100%!

atmel-sha204a I2C failure heap info leak analysis & fix