Linux kernel PMBus hwmon: type confusion in the alert path reads past the attribute allocation

Impact

pmbus_notify() casts every attribute in the group to struct sensor_device_attribute and reads ->index, but the group also holds pmbus_samples_reg and pmbus_sensor objects that only embed a base device_attribute. For pmbus_samples_reg the index read runs past the end of the allocation, a slab out-of-bounds read; for pmbus_sensor the index overlaps page, phase and reg, so a garbage mask can spuriously match during an alert. This is the driver that reads PSU, VRM and hot-swap controller telemetry on high-power GPU chassis, so the practical consequences are a KASAN splat or bogus power-event notifications rather than a tenant-reachable compromise. No attacker path from a workload is established by the record.

Who can reach it

Not reachable from the network or from a tenant workload. The path runs when a PMBus device on the node's I2C/SMBus raises an alert, on a host that has the pmbus hwmon drivers loaded; influencing it deliberately means control of that bus, which is physical access.

What to do

Pick up a stable kernel with the fix at the next scheduled kernel roll and reboot the node - there is no separate vendor advisory and no live-patch path for this. Nodes that do not load pmbus hwmon drivers have no exposure, which is worth checking before it drives any maintenance window of its own.

References

Related entries

• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored