Description
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to. fw_log_from_bo() validated log->header_size and log->size, but fw_log_print_buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs. Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d4e4257afa6ed5205eda993180401fc2c20e4b60 to < 07d4190d75021c38b7994045179aa29131634d4faffectedd4e4257afa6ed5205eda993180401fc2c20e4b60 to < 8ec3d6972f1440fae6c8dadd1859892775208759affectedd4e4257afa6ed5205eda993180401fc2c20e4b60 to < 40868f80a89199630b03d4457876f9a1feba0660affectedd4e4257afa6ed5205eda993180401fc2c20e4b60 to < b1555f63ee1a680f280bc18e8dac416f250e2ec3affectedd4e4257afa6ed5205eda993180401fc2c20e4b60 to < 0724afc55c77c36c7feb9a7264b02aa7593c5c2daffected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.160 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/07d4190d75021c38b7994045179aa29131634d4f ↗
- https://git.kernel.org/stable/c/8ec3d6972f1440fae6c8dadd1859892775208759 ↗
- https://git.kernel.org/stable/c/40868f80a89199630b03d4457876f9a1feba0660 ↗
- https://git.kernel.org/stable/c/b1555f63ee1a680f280bc18e8dac416f250e2ec3 ↗
- https://git.kernel.org/stable/c/0724afc55c77c36c7feb9a7264b02aa7593c5c2d ↗