Описание
A flaw was found in the Linux kernel's octeontx2-af: CGX component. This vulnerability arises from an out-of-bounds array access. Specifically, the RESP_LINKSTAT_SPEED function can produce an index value that exceeds the allocated size of the cgx_speed_mbps array, leading to memory corruption. This could result in a system crash (Denial of Service).
Отчет
A flaw was found in the Linux kernel octeontx2-af driver, in the CGX (Converged Gigabit Ethernet) firmware interface used by Marvell OcteonTX2 network adapters. The RESP_LINKSTAT_SPEED handling can produce a link speed index value that exceeds the bounds of the cgx_speed_mbps lookup array. Because this index is not validated before use, an unexpected firmware response can cause an out-of-bounds array access, leading to memory corruption and a kernel crash. This is classified as CWE-125 (Out-of-bounds Read) and results in a Denial of Service impact. Exploitation requires a system with an affected OcteonTX2 CGX-based network adapter present, consistent with the AV:L and PR:L values in the CVSS vector.
Меры по смягчению последствий
There is no mitigation for this issue other than applying the fix. Systems that do not use OcteonTX2 CGX-based network hardware are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libkrun | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux for NVIDIA 26 | kernel | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.
In the Linux kernel, the following vulnerability has been resolved: o ...
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.
EPSS
5.5 Medium
CVSS3