Executive brief
The Linux kernel's MHI (Modem Host Interface) bus driver fails to validate register offset values read from a device, allowing a malicious or compromised device to supply out-of-bounds offsets that cause invalid memory address calculations and subsequent kernel panic. This affects systems using MHI-compatible modems or devices and can be exploited to cause denial of service.
Technical details
This is a missing bounds-check vulnerability in the MHI host controller initialization code (drivers/bus/mhi/host/init.c). The vulnerability exists in the mhi_init_mmio() function, which reads CHDBOFF (channel doorbell offset) and ERDBOFF (event ring doorbell offset) register values from the device without validating that these offsets fall within the valid MHI register space. If a device supplies an offset value larger than or equal to the register space size minus the required doorbell buffer, an invalid address is computed and used for subsequent register access, triggering a kernel panic. The attack vector is adjacent or local network access to a device implementing the MHI interface. The fix adds explicit range checks before using these offset values, returning -ERANGE if validation fails. Patches are available in mainline and stable kernel branches.
Affected products
- Linux Linux kernel before fix commit 6a0c637bfee69a74c104468544d9f2a6579626d0
Timeline
- 2023-03-24: disclosed
- 2023-05-17: patched
- 2025-10-04: advisory