KVM s390 PCI GAIT Table Indexing Vulnerability

Executive Summary

This vulnerability exists in the Linux kernel's KVM s390 PCI code where certain functions incorrectly calculate an index into the GAIT table. Specifically, the functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() multiply the index by the size of the struct zpci_gaite, even though the pointer is already of that type. This results in a double scaling of the pointer arithmetic, causing out-of-bounds memory accesses when the index (aisb) is 32 or greater.

The issue is fixed by removing the erroneous multiplication by sizeof(struct zpci_gaite), preventing the out-of-bounds access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause out-of-bounds memory accesses in the Linux kernel's KVM s390 PCI subsystem. Such out-of-bounds accesses may lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service, depending on the context and exploitability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by correcting the pointer arithmetic in the Linux kernel's KVM s390 PCI code. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Specifically, apply the patch that removes the erroneous sizeof multiplication in the functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward().

Until the update is applied, avoid running workloads that could trigger out-of-bounds accesses related to the GAIT table indexing on s390 KVM PCI devices.

Useful 0 Not Useful 0