In the Linux kernel, the following vulnerability has been resolved:
net/liquidio: drop cached VF pci_dev LUT
The PF SR-IOV enable path caches VF pci_dev pointers in
dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those
entries do not own a reference, because the iterator drops the previous
device reference on each step. The cached pointer is then dereferenced
later when handling OCTEON_VF_FLR_REQUEST.
Replace the cached VF mapping with runtime lookup on the mailbox DPI
ring: derive the VF index from q_no, resolve the VF via exported PCI
IOV helpers, validate it with the PF pointer and VF ID, then issue
pcie_flr() and drop the reference with pci_dev_put(). Remove the
unused VF lookup table initialization and cleanup.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.3
AV:L - The bug is in the Cavium LiquidIO CN23XX PF driver handling OCTEON_VF_FLR_REQUEST over the PCIe SR-IOV hardware mailbox, not via network packets; exploitation requires code running against an assigned VF (e.g., a cloud VM with SR-IOV passthrough).
AC:L - VF pci_dev pointers in dpiring_to_vfpcidev_lut[] are stale immediately after SR-IOV enable because pci_get_device() drops references during iteration; an attacker controlling VF driver teardown can reliably send OCTEON_VF_FLR_REQUEST and repeat FLR attempts to influence heap reuse.
PR:N - In the highest-impact deployment (multi-tenant cloud with VF passthrough), a tenant needs no host administrator privileges—only control of the assigned VF from within their VM—to trigger PF mailbox processing and pcie_flr() on the dangling pci_dev.
UI:N - No victim interaction is required; triggering VF driver removal or module unload during octeon_destroy_resources() automatically sends the FLR mailbox request to the PF without any user action on the host.
S:C - The vulnerable PF driver executes in the host kernel but is triggered from an isolated VF guest/tenant via the SR-IOV mailbox, crossing the VM/tenant security boundary into host kernel context.
C:H - This is a use-after-free of struct pci_dev; pcie_flr() and pci_dev_reset_iommu_prepare() dereference freed pci_dev fields, enabling arbitrary kernel memory disclosure if the attacker reclaims the object via heap spraying.
I:H - UAF of pci_dev causes pcie_flr() to issue PCI Express FLR config writes and IOMMU blocking on attacker-influenced memory, providing memory corruption primitives that can be leveraged for arbitrary kernel write or code execution.
A:H - Dereferencing a stale pci_dev in pcie_flr() can oops or panic the host kernel, and issuing FLR/IOMMU operations against the wrong PCI function can disrupt host networking and device availability.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is in the Cavium LiquidIO CN23XX PF driver handling OCTEON_VF_FLR_REQUEST over the PCIe SR-IOV hardware mailbox, not via network packets; exploitation requires code running against an assigned VF (e.g., a cloud VM with SR-IOV passthrough).
AC:L - VF pci_dev pointers in dpiring_to_vfpcidev_lut[] are stale immediately after SR-IOV enable because pci_get_device() drops references during iteration; an attacker controlling VF driver teardown can reliably send OCTEON_VF_FLR_REQUEST and repeat FLR attempts to influence heap reuse.
PR:N - In the highest-impact deployment (multi-tenant cloud with VF passthrough), a tenant needs no host administrator privileges—only control of the assigned VF from within their VM—to trigger PF mailbox processing and pcie_flr() on the dangling pci_dev.
UI:N - No victim interaction is required; triggering VF driver removal or module unload during octeon_destroy_resources() automatically sends the FLR mailbox request to the PF without any user action on the host.
S:C - The vulnerable PF driver executes in the host kernel but is triggered from an isolated VF guest/tenant via the SR-IOV mailbox, crossing the VM/tenant security boundary into host kernel context.
C:H - This is a use-after-free of struct pci_dev; pcie_flr() and pci_dev_reset_iommu_prepare() dereference freed pci_dev fields, enabling arbitrary kernel memory disclosure if the attacker reclaims the object via heap spraying.
I:H - UAF of pci_dev causes pcie_flr() to issue PCI Express FLR config writes and IOMMU blocking on attacker-influenced memory, providing memory corruption primitives that can be leveraged for arbitrary kernel write or code execution.
A:H - Dereferencing a stale pci_dev in pcie_flr() can oops or panic the host kernel, and issuing FLR/IOMMU operations against the wrong PCI function can disrupt host networking and device availability.
CVSS 3.1