Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of the

Impact

The option-ROM parser trusts the header and data-structure offsets it reads out of the device's own ROM, so a device presenting a malformed ROM makes the kernel read past the end of the mapped ROM window. Confirmed to page-fault the kernel on x86_64 and to take an alignment fault on arm64 - a panic on a shared node, and the same out-of-bounds read can pull kernel memory adjacent to the ROM mapping.

Who can reach it

The parse runs whenever something reads the device ROM - the PCI sysfs rom attribute, or the ROM region of a passthrough device. That second path is the one that matters here: a tenant VM with a GPU or NIC assigned through /dev/vfio/* reads the VFIO ROM region and the host runs pci_map_rom()/pci_get_rom_size() on ROM content the device supplies. Any device whose ROM contents are attacker-influenced (flashed firmware, a rehosted card, a malicious add-in device) turns this into a host panic. Vendor scores it as needing no privileges.

What to do

Boot a kernel with the ROM header and data-structure address/alignment checks in pci_get_rom_size(). Interim: do not expose the ROM region to guests (mask the VFIO ROM region / disable ROM BAR on assigned devices), keep the PCI sysfs rom attribute out of containers, and refuse nodes with cards whose firmware provenance you cannot vouch for.

References