In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify<\/p>\n
rvu_mbox_handler_rep_event_notify() in drivers\/net\/ethernet\/marvell\/
\nocteontx2\/af\/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY
\nrequest body verbatim, and rvu_rep_up_notify() then forwards
\nevent->pcifunc (the nested body field, distinct from the
\nAF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and
\nthe AF->PF mailbox device index without any bounds check.<\/p>\n
A VF attached to a PF that has been put into switchdev
\nrepresentor mode reaches this path: the VF mailbox handler
\notx2_pfvf_mbox_handler() forwards every message id including
\nMBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF
\ndispatcher rewrites only msg->pcifunc, leaving struct
\nrep_event::pcifunc attacker-controlled. The sibling
\nrvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc
\nis not rvu->rep_pcifunc; this handler has no equivalent gate.<\/p>\n
An out-of-range body pcifunc selects an &rvu->pf[]\/&rvu->hwvf[]
\nelement past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE,
\nturns into a six-byte attacker-chosen OOB ether_addr_copy() target
\ninside the queued worker; KASAN reports a slab-out-of-bounds write
\nin rvu_rep_wq_handler.<\/p>\n
Reject malformed requests at the handler entry by gating on
\nis_pf_func_valid(), which is already the canonical PF\/VF range check
\nin this driver; expose it via rvu.h so callers in rvu_rep.c can use
\nit instead of open-coding the same range arithmetic.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify<\/p>\n
rvu_mbox_handler_rep_event_notify() in drivers\/net\/ethern<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14961","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14961"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}