Executive Summary

This vulnerability exists in the Linux kernel's accel/ethosu component, specifically in the dma_length() function. The function calculates DMA region usage based on command stream values and updates region sizes. However, several arithmetic issues occur: signed stride values can underflow, intermediate multiplications can overflow, and additions involving offsets can overflow. Additionally, dma_length() error returns were not properly validated by the caller.

These arithmetic errors can corrupt the calculated region size, causing the system to under-report the actual DMA region usage. Since region_size[] is used later to validate command stream accesses against buffer sizes, this under-reporting can allow bounds validation to be bypassed, potentially leading to unsafe memory accesses.

The fix involved validating signed additions, using overflow helpers for multiplications and offset updates, and ensuring dma_length() failures are properly propagated to the caller.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to bypassing bounds validation in the Linux kernel's ethosu driver. Because the region size calculations can be corrupted by arithmetic errors, the system may under-report memory usage, allowing command streams to access memory outside of their intended buffers.

Such out-of-bounds memory accesses can cause data corruption, system instability, or potentially allow an attacker to execute arbitrary code or escalate privileges, depending on how the affected component is used.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by validating signed additions, using overflow helpers for multiplications and offset updates, and propagating dma_length() failures to the caller in the Linux kernel's accel/ethosu component.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0