Linux kernel cxl/ras: RCH AER capability copy reads past the mapped register block

Impact

cxl_rch_get_aer_info() bounded its readl() loop by sizeof(struct aer_capability_regs), a software layout that has grown past the on-wire AER capability as struct pcie_tlp_log gained fields. The loop therefore reads MMIO beyond the mapped AER block and fills software-only tail fields, including header_log.header_len, with whatever it picked up; an out-of-range header_len then makes pcie_print_tlp_log() over-read a second buffer. On hosts using CXL memory expanders behind an RCH downstream port - increasingly common in large-memory AI and inference nodes - this fires on the error-handling path, so it is triggered by device error conditions rather than by a clean attacker-chosen input. Scored as a local high-confidentiality issue; realistic effect is kernel memory disclosure into logs and traces, plus unpredictable behaviour while handling a real CXL error.

Who can reach it

Local. Requires the host to have a CXL RCH downstream port whose AER path is exercised; a local user with access to kernel error logs or trace output can see the disclosed contents. Hosts with no CXL devices do not execute this code.

What to do

Update the host kernel to a build that bounds the read to the physical AER registers and zeroes the destination (stable commits 29458e62d082, 8bd3523df131, 8e3d9dbb25d3), then drain and reboot the node. No module-level or runtime mitigation is documented. Nodes without CXL memory devices can be deprioritised in the rollout.

References

Related entries

• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High
• Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mountCVE-2023-0386 · Linux kernel (OverlayFS/FUSE)High