Linux Kernel vhost VDPA Group Bound Check Vulnerability

A vulnerability in the Linux kernel's vhost component related to Virtual Data Path Accelerated (VDPA) devices has been addressed. The issue involved improper group bound checks, which could lead to out-of-bounds writes. This vulnerability was particularly relevant for the mlx5 VDPA simulation driver.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory writes, potentially causing memory corruption.

Reproduction

The vulnerability can be reproduced by assigning a valid Address Space Identifier (ASID) to a VDPA group that is equal to the number of groups, which triggers an out-of-bounds write. This can be done through the vhost VDPA interface by sending a command that includes the group index and ASID.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.