Executive Summary

This vulnerability exists in the Linux kernel's KVM s390 PCI code where certain functions incorrectly calculate an index into the GAIT table. Specifically, the functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() multiply the index by the size of the struct zpci_gaite, even though the pointer is already of that type. This results in a double scaling of the pointer arithmetic, causing out-of-bounds memory accesses when the index (aisb) is 32 or greater.

The issue is fixed by removing the erroneous multiplication by sizeof(struct zpci_gaite), preventing the out-of-bounds access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause out-of-bounds memory accesses in the Linux kernel's KVM s390 PCI subsystem. Such out-of-bounds accesses may lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service, depending on the context and exploitability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by correcting the pointer arithmetic in the Linux kernel's KVM s390 PCI code. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Specifically, apply the patch that removes the erroneous sizeof multiplication in the functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward().

Until the update is applied, avoid running workloads that could trigger out-of-bounds accesses related to the GAIT table indexing on s390 KVM PCI devices.

Useful 0 Not Useful 0