Executive Summary

This vulnerability exists in the Linux kernel's accel/ethosu component, specifically in the ethosu_gem_cmdstream_copy_and_validate() function. The issue arises because the command stream parsing loop increments an index variable twice when a 64-bit command word is encountered, but it does not check if the index is still within the buffer bounds before writing the second word.

As a result, when the index reaches the last valid position, the code writes four bytes past the end of the allocated buffer, causing an out-of-bounds (OOB) write. Since userspace controls both the buffer contents and its size via an ioctl call, this vulnerability can be triggered from userspace, leading to a heap out-of-bounds write.

The fix involves adding a check to ensure the incremented index does not exceed the buffer bounds before performing the second write, returning an error if the buffer is too small.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a heap out-of-bounds write in the Linux kernel, which may cause memory corruption. Since userspace can trigger this condition, it could potentially be exploited to crash the system, cause denial of service, or possibly execute arbitrary code with kernel privileges.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by adding a check on the incremented index against the buffer bound before performing the second write in the command stream parsing loop. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Since the issue is triggered by userspace controlling the buffer contents and size via an ioctl, restricting or monitoring access to the relevant ioctl interface can reduce risk until the kernel is patched.

Useful 0 Not Useful 0