Executive Summary

This vulnerability exists in the Linux kernel's PCI endpoint driver pci-ep-msi. The function pci_epf_alloc_doorbell() allocates a doorbell message array and stores it in the endpoint function's state before requesting MSI (Message Signaled Interrupts) vectors. If the MSI allocation fails, the allocated array is freed, but the endpoint function's state still points to the freed memory. This can lead to a double-free error during cleanup or attempts to retry allocation.

The fix involves clearing the pointers to the doorbell message array and its count on MSI allocation failure, preventing double-free errors and allowing safe retries. Additionally, the function now returns an error (-EBUSY) if doorbells have already been allocated, preventing leaks or overwriting existing allocations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption in the Linux kernel due to double-free errors or use-after-free conditions. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges if exploited.

In practical terms, this could compromise the reliability and security of systems running vulnerable versions of the Linux kernel, especially those using PCI endpoint functions with MSI doorbell allocations.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the pci-ep-msi endpoint to properly handle MSI allocation failures and prevent double freeing of memory.

To mitigate this vulnerability, you should update your Linux kernel to the version that includes this fix.

Useful 0 Not Useful 0