CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the microchip-spi FPGA driver, specifically in the `mpf_ops_parse_header()` function, which can lead to an out-of-bounds read when the `header_size` is set to zero. This flaw allows for potential memory access violations, which could be exploited to read sensitive data or cause instability in the system. Organizations using Linux with this FPGA driver should prioritize patching this vulnerability to mitigate risks associated with memory corruption and unauthorized data access.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.