CVE-2024-26768

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]

With default config, the value of NR_CPUS is 64. When HW platform has

more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC

is the maximum cpu number in MADT table (max physical number) which can

exceed the supported maximum cpu number (NR_CPUS, max logical number),

but kernel should not crash. Kernel should boot cpus with NR_CPUS, let

the remainder cpus stay in BIOS.

The potential crash reason is that the array acpi_core_pic[NR_CPUS] can

be overflowed when parsing MADT table, and it is obvious that CORE_PIC

should be corresponding to physical core rather than logical core, so it

is better to define the array as acpi_core_pic[MAX_CORE_PIC].

With the patch, system can boot up 64 vcpus with qemu parameter -smp 128,

otherwise system will crash with the following message.

[ 0.000000] CPU 0 Unable to handle kernel paging request

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References