CVE-2023-54129

Vulnerability

The Linux kernel's octeontx2-af driver lacks validation of the lmac_type_id field received from firmware during physical link change notifications. When an invalid lmac_type_id is provided, the kernel derives an incorrect lmac_type, leading to a crash in strncpy and resulting in a kernel panic (Oops). [1]

Exploitation

An attacker with the ability to influence firmware responses or trigger a physical link change (e.g., through local access to a Marvell CN103XX board) can cause the firmware to send a malformed lmac_type_id. The panic occurs in a workqueue context (work_for_cpu_fn), requiring no authentication beyond local access to the affected hardware. [1][2]

Impact

The vulnerability results in a denial of service (system crash). No privilege escalation is described; the primary impact is availability loss.

Mitigation

The fix adds validation of the lmac_type_id field before it is used. The patch has been backported to stable kernel versions as seen in the referenced commits [1][2]. Users should update their kernels to include the fix.