CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's mailbox implementation for RISC-V, where insufficient validation of the RPMI notification lengths can lead to potential memory corruption. This flaw allows for improper handling of shared memory, which could be exploited to read beyond allocated buffers, potentially leading to information disclosure or system instability. Organizations using Linux on RISC-V architectures should prioritize addressing this issue to mitigate risks associated with memory management vulnerabilities.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record. Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data.