CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's mana_hwc_rx_event_handler function, where a lack of bounds checking on the rx_req_idx variable can lead to out-of-bounds array access in Confidential VMs using SEV-SNP or TDX. This flaw poses a critical risk, as it allows potential attackers to manipulate memory contents, leading to unauthorized access or corruption of data. Organizations utilizing Linux in environments with Confidential VMs should prioritize patching this vulnerability to mitigate the associated risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.