Linux Kernel TOCTOU Vulnerability in Microsoft Azure Network Adapter Driver

A time-of-check to time-of-use (TOCTOU) vulnerability has been identified in the Linux kernel's Microsoft Azure Network Adapter (MANA) driver. This issue arises in the 'mana_hwc_rx_event_handler()' function, where the 'hwc_msg_id' is read from a Direct Memory Access (DMA)-coherent buffer. Although the value is initially bounds-checked, it is subsequently re-read from the same buffer in the 'mana_hwc_handle_resp()' function for bit testing and pointer arithmetic. This double-fetch creates a window of opportunity for hardware to alter the 'hwc_msg_id' between the validation check and its actual use, potentially leading to improper bounds validation. The vulnerability is particularly concerning in Confidential Virtual Machines (CVMs) using SEV-SNP or TDX, where DMA memory is shared, unencrypted, and directly visible to the host, allowing for such modifications.

Impact

Exploitation of this vulnerability could result in incorrect handling of message IDs, potentially leading to miscommunication between the virtual machine and the host, and causing disruptions in network operations or data integrity.

Reproduction

The vulnerability can be reproduced by triggering a reception event in the MANA driver while the 'hwc_msg_id' is being processed. This can be done by simulating network traffic that requires the driver to read and respond to messages. The double-fetch vulnerability can be observed by monitoring the 'hwc_msg_id' as it is read from the DMA buffer, validated, and then re-read for processing. In a Confidential VM environment, the 'hwc_msg_id' can be modified by the host between these reads, demonstrating the TOCTOU flaw.

Remediation

The vulnerability has been addressed by modifying the driver to read the 'hwc_msg_id' only once, using the 'READ_ONCE()' function to ensure a consistent and validated value is passed to the response handling function. Users should update to the latest version of the Linux kernel where this fix has been applied.