Executive brief
A vulnerability in the Linux kernel's ACPI component could allow a local user to cause a system crash. The issue occurs when the system attempts to read or write memory across certain boundaries, leading to a kernel failure. This primarily impacts the availability of the system rather than the confidentiality of user data.
Technical details
A NULL pointer dereference exists in the Linux kernel's ACPICA (ACPI Component Architecture) implementation within the acpi_ex_system_memory_space_handler function in drivers/acpi/acpica/exregion.c. The vulnerability was introduced by a previous commit intended to prevent memory mappings from overlapping page boundaries. When a mapping request hits a page boundary, the kernel would truncate the mapping but still attempt to read or write the full requested length, resulting in a NULL pointer dereference. An attacker with local access could potentially trigger this condition to cause a kernel panic. The fix involves reverting the restrictive mapping logic to allow mappings to span across page boundaries as permitted by the ACPI specification.
Affected products
- Linux Linux Kernel 2.6.32 to 4.19.317, 4.20 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7, 6.10-rc1 to 6.10-rc4
Timeline
- 2024-06-14: patched: Initial patch authored by Raju Rangoju
- 2024-07-12: disclosed: CVE published
References
- https://git.kernel.org/stable/c/434c6b924e1f4c219aab2d9e05fe79c5364e37d3
- https://git.kernel.org/stable/c/435ecc978c3d5d0c4e172ec5b956dc1904061d98
- https://git.kernel.org/stable/c/6eca23100e9030725f69c1babacd58803f29ec8d
- https://git.kernel.org/stable/c/a83e1385b780d41307433ddbc86e3c528db031f0
- https://git.kernel.org/stable/c/ae465109d82f4fb03c5adbe85f2d6a6a3d59124c
- https://git.kernel.org/stable/c/dc5017c57f5eee80020c73ff8b67ba7f9fd08b1f
- https://git.kernel.org/stable/c/ddc1f5f124479360a1fd43f73be950781d172239