Linux kernel (drivers/vfio/pci/qat): Two concurrent writes to the QAT VF migration-resume file both pass the bounds

Impact

Two concurrent writes to the QAT VF migration-resume file both pass the bounds check against a stale file offset, then copy past the end of the kernel migration-state buffer. Whoever can write that fd gets a controlled kernel heap overflow with attacker-supplied bytes - a straightforward path from a device-holder to host privilege.

Who can reach it

Whoever holds the vfio migration file descriptor for a QAT VF: the VMM restoring a migrated guest, or a tenant handed the device directly. Two threads writing the fd concurrently is the whole exploit. Conditional on the qat_vfio_pci variant driver being bound to an Intel QuickAssist VF - not reachable on nodes that do not pass through QAT VFs.

What to do

Update to a stable kernel carrying commits 6465af00 / d416dcef. Interim: if you do not live-migrate QAT VFs, bind them to plain vfio-pci instead of qat_vfio_pci, or stop passing QAT VFs to tenants until the kernel is patched.

References