In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF<\/p>\n
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
\nindex into the LMT map table to read another function’s LMTLINE
\nphysical base address and copy it into the caller’s own LMT map table
\nentry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
\nIRQ source, but req->base_pcifunc is a separate payload field and is
\nnot sanitized.<\/p>\n
Reject the request with -EPERM when a VF caller’s base_pcifunc is not a
\nvalid function under its own PF. is_pf_func_valid() bounds the FUNC field
\nto the PF’s configured VF count, keeping the computed index inside the
\ncaller’s own slot block.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF<\/p>\n
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a dire<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6744","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}