Описание
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: add bounds check for if_id in IRQ handler
The IRQ handler extracts if_id from the upper 16 bits of the hardware
status register and uses it to index into ethsw->ports[] without
validation. Since if_id can be any 16-bit value (0-65535) but the ports
array is only allocated with sw_attr.num_ifs elements, this can lead to
an out-of-bounds read potentially.
Add a bounds check before accessing the array, consistent with the
existing validation in dpaa2_switch_rx().
A flaw was found in the Linux kernel's dpaa2-switch component. The Interrupt Request (IRQ) handler improperly validates the 'if_id' value extracted from the hardware status register before using it to access an internal array. This lack of validation allows an attacker to provide an 'if_id' that can lead to an out-of-bounds read. This vulnerability could result in information disclosure, data corruption, or a denial of service.
Отчет
A moderate-severity flaw was found in the Linux kernel's dpaa2-switch driver. The interrupt (IRQ) handler extracts the if_id value from the upper 16 bits of the hardware status register and uses it to index the ethsw->ports[] array without first validating it against the number of ports allocated for the switch (sw_attr.num_ifs). Because if_id can be any 16-bit value (0-65535) while the ports array is only sized for sw_attr.num_ifs entries, an if_id value beyond the array bounds results in an out-of-bounds read, potentially causing information disclosure, data corruption, or a denial of service (system crash). Exposure is limited to systems using the affected dpaa2-switch networking driver. Red Hat Enterprise Linux 6, 7, 8, and 9 (including the Real Time kernel packages) are not affected because the vulnerable code is not present in those streams. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix for these products is deferred to a future planned update rather than an immediate z-stream fix. Until a fixed kernel is delivered, the residual risk on affected products is an out-of-bounds read in the dpaa2-switch IRQ handler, which requires the dpaa2-switch driver and its networking hardware to be in use. The upstream CVE record rates this flaw as important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), while Red Hat rates it as moderate with a CVSS 3.1 score of 5.0, reflecting Red Hat's assessment of high attack complexity and low confidentiality, integrity, and availability impact for this driver-specific issue.
Меры по смягчению последствий
To mitigate this vulnerability, prevent the dpaa2_switch kernel module from loading. Create /etc/modprobe.d/dpaa2_switch.conf with the following content:
install dpaa2_switch /bin/true
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact network functionality if dpaa2-switch hardware is in use.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
Уязвимость компонента dpaa2-switch ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5 Medium
CVSS3