Executive Summary

This vulnerability exists in the Linux kernel's ibmasm component, specifically in the function ibmasm_handle_mouse_interrupt(). It involves an out-of-bounds (OOB) memory-mapped I/O (MMIO) read triggered when hardware provides a queue reader or writer index that exceeds the allowed REMOTE_QUEUE_SIZE (60).

The problem arises because the function get_queue_reader() and get_queue_writer() return raw hardware values without checking if they are within valid bounds. These values are then used to calculate an address for reading data without verifying if the address is valid, leading to reading from unintended device registers or even outside the PCI BAR mapping. This can cause a machine check exception.

A compromised service processor can exploit this by writing out-of-range values to the reader or writer MMIO registers before triggering an interrupt, causing the kernel to perform these unsafe reads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the Linux kernel performing out-of-bounds reads from device registers, which may cause system instability or crashes due to machine check exceptions.

If an attacker has control over the service processor, they could exploit this flaw to disrupt normal system operation or potentially cause denial of service by triggering these exceptions.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by adding bounds checks on the reader and writer indices against REMOTE_QUEUE_SIZE before accessing the queue entries.

Specifically, the fix involves resetting the reader register to 0 via set_queue_reader() if an out-of-range value is detected, allowing normal queue operation to resume if the corrupted hardware state is transient.

Therefore, the immediate mitigation step is to update the Linux kernel to a version that includes this fix for the ibmasm driver.

Useful 0 Not Useful 0