CVE-2024-38606: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-38606 affects the Linux kernel's crypto QAT (Quick Assist Technology) driver. The vulnerability was discovered in the telemetry feature where the function adf_send_admin_tl_start() enables telemetry on a QAT device by sending the ICP_QAT_FW_TL_START message to the firmware. The issue was disclosed in June 2024 and affects Linux kernel versions from 6.8 up to (excluding) 6.8.12 and from 6.9 up to (excluding) 6.9.3 (NVD).

The vulnerability stems from insufficient validation of the slice count array returned by the firmware. When the telemetry feature is enabled, the firmware returns an array containing the number of accelerators of each type (slices) supported by the hardware. This array is stored in the adf_tl_hw_data data structure's slice_cnt field and is used by the tl_print_dev_data() function to report statistics about supported accelerators in debugfs. An incorrect value in the slice_cnt array could lead to an out-of-bounds memory read (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability could allow an attacker to perform an out-of-bounds memory read, potentially leading to information disclosure from kernel memory. While there is no current implementation of firmware that returns incorrect values, the vulnerability represents a potential security risk for systems using the QAT driver (NVD).

The vulnerability requires local access and low privileges to exploit. At the time of disclosure, there was no known implementation of firmware that returns incorrect values that could trigger this vulnerability (Kernel Patch).

The vulnerability has been fixed by adding validation for the slice count array returned by the firmware. The fix includes a new validation function validate_tl_slice_counters() that checks if the returned values exceed the maximum allowed slices per type. The patch has been merged into the Linux kernel (Kernel Patch).