In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
Smatch warns:
arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential
spectre issue 'args.args' [r] (local cap)
The 'nargs' and 'nret' locals come directly from a user-supplied
buffer and are used as indexes into a small stack-based array and as
inputs to copy_to_user() after they are subject to bounds checks.
Use array_index_nospec() after the bounds checks to clamp these values
for speculative execution.
Metrics
Affected Vendors & Products
References
History
Wed, 18 Sep 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
| |
Metrics |
threat_severity
|
cvssV3_1
|
Wed, 18 Sep 2024 07:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. | |
Title | powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() | |
References |
|
MITRE
Status: PUBLISHED
Assigner: Linux
Published: 2024-09-18T07:12:31.782Z
Updated: 2024-09-18T07:12:31.782Z
Reserved: 2024-09-11T15:12:18.275Z
Link: CVE-2024-46774
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2024-09-18T08:15:05.180
Modified: 2024-09-20T12:30:51.220
Link: CVE-2024-46774
Redhat