accel/ivpu: Validate firmware log buffer metadata
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.111, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to. fw_log_from_bo() validated log->header_size and log->size, but fw_log_print_buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs. Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From d4e4257afa6ed5205eda993180401fc2c20e4b60 · fixed in 07d4190d75021c38b7994045179aa29131634d4f; From d4e4257afa6ed5205eda993180401fc2c20e4b60 · fixed in 8ec3d6972f1440fae6c8dadd1859892775208759; From d4e4257afa6ed5205eda993180401fc2c20e4b60 · fixed in 40868f80a89199630b03d4457876f9a1feba0660; From d4e4257afa6ed5205eda993180401fc2c20e4b60 · fixed in b1555f63ee1a680f280bc18e8dac416f250e2ec3; From d4e4257afa6ed5205eda993180401fc2c20e4b60 · fixed in 0724afc55c77c36c7feb9a7264b02aa7593c5c2d
- Linux Linux
6.6
- KernelLinux
From 6.6.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7