CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of feature requests in the CXL (Compute Express Link) subsystem, specifically in the `cxlctl_get_feature()` function. An attacker could exploit this flaw to perform a heap out-of-bounds write by sending a request with a count larger than the allocated output buffer, potentially leading to memory corruption. Organizations using Linux systems with CXL support should prioritize addressing this vulnerability to mitigate risks associated with unauthorized access or system instability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC. Reject requests where count exceeds the available payload room, before allocating.