Out-of-Bounds Read in Linux dpaa2-switch IRQ Handler

Executive Summary

This vulnerability exists in the Linux kernel's dpaa2-switch component. The IRQ handler extracts an interface ID (if_id) from the upper 16 bits of a hardware status register and uses this value to index into an array called ethsw->ports[]. However, the if_id value can be any 16-bit number (0-65535), while the ports array only contains a limited number of elements defined by sw_attr.num_ifs. Because there is no validation or bounds check on if_id before accessing the array, this can lead to an out-of-bounds read.

The vulnerability was fixed by adding a bounds check to ensure that if_id is within the valid range before accessing the ports array, preventing potential out-of-bounds memory access.

Useful 0 Not Useful 0

Impact Analysis

An out-of-bounds read vulnerability like this can potentially lead to information disclosure or system instability. Since the IRQ handler reads memory outside the bounds of the ports array, it might access unintended memory areas, which could expose sensitive data or cause unexpected behavior in the kernel.

However, the exact impact depends on how the system uses the affected component and whether an attacker can exploit this condition to gain useful information or cause a denial of service.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0