CVE-2024-46822

arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry

published September 27, 2024

CVSS
—
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry

In a review discussion of the changes to support vCPU hotplug where

a check was added on the GICC being enabled if was online, it was

noted that there is need to map back to the cpu and use that to index

into a cpumask. As such, a valid ID is needed.

If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible

for the entry in cpu_madt_gicc[cpu] == NULL. This function would

then cause a NULL pointer dereference. Whilst a path to trigger

this has not been established, harden this caller against the

possibility.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Published
2024-09-27T12:39Z
EPSS history
Timeline
  • 27 SEP 12:39Z
    arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
    cvelistv5