Description

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 2064). The receive buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a 16-byte heap buffer overflow. The hinic3 driver already handles this correctly by defining MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it exceeds the remaining buffer space. Apply the same fix to the hinic driver.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T11:17:23.367Z",
  "pubdate": "2026-09-25T11:17:23.367Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the Linux kernel's hinic network driver mailbox handling logic.\nThe vulnerability arises from improper validation of mailbox segment lengths, allowing an attacker to write past the allocated boundaries of the receive buffer.\nThis flaw affects systems utilizing the hinic driver for network communications.\nSuccessful exploitation could allow an attacker to corrupt adjacent kernel memory, potentially leading to a system crash (Denial of Service) or arbitrary code execution.\nThe issue stems from a logic error in check_mbox_seq_id_and_seg_len(), which fails to account for the remaining capacity of the buffer when processing the final mailbox segment.\nTo exploit this, an attacker must have the ability to influence the mailbox segment sequence, typically requiring access to the hardware interface or a privileged user space application capable of interacting with the driver.\nThe risk is critical as it involves kernel-level memory corruption.",
  "technicalDetails": "The vulnerability is located in the function check_mbox_seq_id_and_seg_len() within the hinic driver. The core issue is an off-by-error in the length validation logic for mailbox segments. The driver uses a maximum sequence ID (SEQ_ID_MAX_VAL) of 42 and a maximum segment length (MBOX_SEG_LEN) of 48 bytes. The receive buffer is constrained to a fixed size, MBOX_MAX_BUF_SZ, defined as 2048 bytes.\nUnder the existing implementation, the validation logic allows a segment with seq_id 42 and seg_len 48. Because the buffer offsets are calculated as (seq_id * MBOX_SEG_LEN), the driver attempts to write the 48-byte payload starting at offset 2016 (42 * 48). This write operation extends to byte 2064, which is 16 bytes beyond the allocated 2048-byte heap buffer.\nThe attack flow involves an adversary crafting a sequence of mailbox segments that intentionally trigger the final sequence ID check. By supplying a full 48-byte payload for the final segment, the attacker forces the kernel to copy data into memory outside the bounds of the statically or dynamically allocated receive buffer. Since this buffer resides in kernel heap memory, the resulting overflow can overwrite adjacent structures, including function pointers, object metadata, or other critical kernel data objects.\nThe exploitation process typically involves: 1) Establishing communication with the hinic driver; 2) Crafting a multi-segment mailbox message where the last segment is positioned to cause the overflow; 3) Supplying malicious data in the final segment payload; 4) Triggering the kernel to process this message, thereby executing the out-of-bounds write. Depending on the memory layout and the presence of kernel protections such as KASLR or heap integrity checks, an attacker might gain control over the kernel's execution flow or cause a kernel panic due to memory corruption.\nThis vulnerability highlights a discrepancy in driver evolution, as the more recent hinic3 driver already incorporates a fix by defining MBOX_LAST_SEG_MAX_LEN to strictly enforce boundary checks. The hinic driver fails to account for the physical constraints of the heap allocation, making it susceptible to memory corruption when segments are at their maximum allowable size."
}