PowerPC pSeries papr-phy-attest Memory Leak and Buffer Overflow

Executive Summary

This is a vulnerability in the Linux kernel affecting the powerpc/pseries platform. It involves improper validation of the cmd.length parameter in papr_phy_attest_create_handle(), which can lead to a buffer overflow. Additionally, there is a memory leak where the params structure is not freed on error paths or when a negative file descriptor is encountered.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's powerpc/pseries subsystem and relates to the papr-phy-attest functionality. Detection requires checking kernel versions and examining the affected code paths. No direct network detection commands are applicable. Review kernel logs for errors related to papr_phy_attest_create_handle or memory allocation failures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to cause a buffer overflow, potentially leading to system crashes, data corruption, or privilege escalation. The memory leak may cause gradual system resource exhaustion, impacting performance and stability.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, disable the papr-phy-attest feature by removing or blacklisting the relevant kernel module. Monitor kernel logs for signs of exploitation attempts or memory leaks.

Useful 0 Not Useful 0