ACPI: CPPC: Avoid out of bounds access when parsing _CPC data in Kernel
Summary
GSD-2022-1001750: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data. Affects Kernel versions >= 337aadff8e4567e39669e07d9a88b789d78458b5, < 97b5593fd1b182b3fdb180b6bbe64ec09669988b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functions and services to enable the proper functioning of the system. The ACPI (Advanced Configuration and Power Interface) subsystem within the Kernel handles power management and configuration of hardware devices. One of the features of ACPI is CPPC (Collaborative Processor Performance Control), which allows for dynamic adjustment of processor performance based on system requirements. However, a vulnerability has been discovered in the Kernel's ACPI CPPC implementation that could lead to out of bounds access when parsing _CPC (Collaborative Processor Control) data.
Vulnerability Detail
The vulnerability in the ACPI CPPC implementation of the Kernel arises from a flaw in parsing _CPC data. When processing this data, the Kernel does not properly validate the input, leading to an out of bounds access issue. An attacker could exploit this vulnerability by crafting a malicious ACPI table that triggers the out of bounds access, potentially resulting in arbitrary code execution or a denial of service. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Kernel version v4.4 and has been fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the ACPI CPPC feature by modifying the Kernel boot parameters. This can be achieved by adding the 'cppc=off' parameter to the Kernel command line during boot. However, disabling this feature may impact the performance and power management capabilities of the system.
Conclusion
The vulnerability in the ACPI CPPC implementation of the Kernel can potentially lead to out of bounds access when parsing _CPC data. It is crucial to update the Kernel to version v5.15.33 or later to mitigate this vulnerability. Users can also disable the ACPI CPPC feature as a temporary workaround, but this may impact system performance and power management capabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functions and services to enable the proper functioning of the system.
ACPI (Advanced Configuration and Power Interface) is a standard for power management and configuration of hardware devices in computers. It provides a framework for the operating system to control and manage various aspects of power and hardware configuration.
ACPI CPPC (Collaborative Processor Performance Control) is a feature of ACPI that allows for dynamic adjustment of processor performance based on system requirements. It enables the operating system to optimize power consumption and performance by controlling the processor's frequency and voltage.
Out of bounds access refers to accessing memory or data outside the boundaries of a defined range. In the context of this vulnerability, it means accessing memory beyond what is intended or allowed, which can lead to various security issues, including arbitrary code execution or denial of service.
The process of updating the Kernel depends on the Linux distribution you are using. Generally, it involves using the package manager of your distribution to install the latest Kernel updates. Alternatively, you can manually compile and install the updated Kernel from the official source.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
