Linux Kernel Out-of-Bounds Array Access Vulnerability in Microsoft Azure Network Adapter Driver

A vulnerability allowing out-of-bounds array access has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises in the 'mana_hwc_rx_event_handler()' function, where the 'rx_req_idx' is calculated from 'sge->address' in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted, allowing hardware to alter Work Queue Element (WQE) contents at any time. The lack of a bounds check on 'rx_req_idx' can lead to unauthorized access into the 'reqs[]' array, potentially causing memory corruption or other unintended behavior.

Impact

Exploitation of this vulnerability can lead to out-of-bounds memory access, which may cause memory corruption or allow for arbitrary code execution.

Reproduction

To reproduce this vulnerability, use a Confidential VM (SEV-SNP or TDX) and trigger a reception event in the Microsoft Azure Network Adapter (MANA) driver. The 'rx_req_idx' will be calculated based on the 'sge->address', which can be manipulated to exceed the bounds of the 'reqs[]' array, causing an out-of-bounds access.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The patch is included in the official Linux Git repository.