NetSight
IP …
medium5.5

CVE-2024-46822

In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussion …

Impact

In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was online, it was noted that there is need to map back to the cpu and use that to index into a cpumask. As such, a valid ID is needed. If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL pointer dereference. Whilst a path to trigger this has not been established, harden this caller against the possibility.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 5.4.284
from 5.5 before 5.10.226
from 5.11 before 5.15.167
from 5.16 before 6.1.110
from 6.2 before 6.6.51
from 6.7 before 6.10.10

Weakness classification

CWE-476

References