CVE-2024-40974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Enforce hcall result buffer validity and size

plpar_hcall(), plpar_hcall9(), and related functions expect callers to

provide valid result buffers of certain minimum size. Currently this

is communicated only through comments in the code and the compiler has

no idea.

For example, if I write a bug like this:

long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE

plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);

This compiles with no diagnostics emitted, but likely results in stack

corruption at runtime when plpar_hcall9() stores results past the end

of the array. (To be clear this is a contrived example and I have not

found a real instance yet.)

To make this class of error less likely, we can use explicitly-sized

array parameters instead of pointers in the declarations for the hcall

APIs. When compiled with -Warray-bounds[1], the code above now

provokes a diagnostic like this:

erro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References