PT-2026-61351 · Linux · Linux
CVE-2026-64034
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
9.3
Crítica
| Vetor | AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Fix TOCTOU double-fetch of hwc msg id from DMA buffer
In mana hwc rx event handler(), resp->response.hwc msg id is read from
DMA-coherent memory and bounds-checked, then mana hwc handle resp()
re-reads the same field from the same DMA buffer for test bit() and
pointer arithmetic.
DMA-coherent memory is mapped uncacheable on x86 and is shared,
unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes
directly to host-visible memory. A H/W can modify the value
between the check and the use, bypassing the bounds validation.
Fix this by reading hwc msg id exactly once using READ ONCE() into a
stack-local variable in mana hwc rx event handler(), and passing the
validated value as a parameter to mana hwc handle resp().
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux