Linux kernel (drivers/vfio/platform): Vfio-platform never bounds-checked the count and offset a caller passes to

Impact

Vfio-platform never bounds-checked the count and offset a caller passes to read()/write() on the device fd - only offset was masked to 40 bits. The holder of the device node gets an arbitrary out-of-bounds read and write past the end of the mapped device region, straight from the passthrough boundary that is supposed to contain them.

Who can reach it

Any tenant process or VMM holding /dev/vfio/* for a vfio-platform device issues a plain read() or write() on the device fd with an oversized count or a crafted offset. No ioctl gymnastics, no host root. Conditional on the vfio-platform (or vfio-amba) driver being in use - this is the non-PCI passthrough path, common on Arm SoC and embedded-style nodes rather than on vfio-pci GPU passthrough - so check whether your Arm hosts load it before deciding this is out of scope.

What to do

No fixed release is listed in this record; apply the linked stable commits or move to a current stable/LTS kernel. Interim: blacklist vfio-platform / vfio-amba on nodes that only need PCI passthrough, and drop vfio-platform device nodes out of tenant containers.

References