ACPI: CPPC: Avoid out of bounds access when parsing _CPC data in Kernel
Summary
GSD-2022-1002023: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data. Affects Kernel versions >= 337aadff8e4567e39669e07d9a88b789d78458b5, < e5b681822cac1f8093759b02e16c06b2c64b6788. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The ACPI (Advanced Configuration and Power Interface) subsystem within the Kernel handles power management and device configuration. The CPPC (Collaborative Processor Performance Control) feature in ACPI allows for dynamic performance scaling of processors. However, a vulnerability has been identified in the Kernel's ACPI CPPC implementation that can lead to out of bounds access when parsing _CPC data.
Vulnerability Detail
The vulnerability in the ACPI CPPC implementation arises from a flaw in handling _CPC data. When parsing this data, the Kernel does not properly validate the input, leading to an out of bounds access issue. An attacker could exploit this vulnerability by crafting a malicious ACPI table, which, when loaded, triggers the out of bounds access. This could potentially result in arbitrary code execution or a denial of service condition. The vulnerability was introduced in Kernel version v4.4 and has been fixed in version v5.10.110.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the CPPC feature in ACPI by modifying the system's BIOS settings. However, this may result in a loss of performance scaling capabilities for processors. It is advisable to consult the system's documentation or contact the hardware manufacturer for guidance on modifying BIOS settings.
Conclusion
The ACPI CPPC vulnerability in the Kernel's ACPI subsystem poses a risk of out of bounds access when parsing _CPC data. This could potentially lead to arbitrary code execution or a denial of service condition. To mitigate this vulnerability, it is crucial to update the Kernel to version v5.10.110 or later. Disabling the CPPC feature in ACPI through BIOS settings can serve as a temporary workaround, but it may impact processor performance scaling capabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service on a system running the affected Kernel version.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in Kernel version v5.10.110. It is recommended to update to this version or a later one to mitigate the risk.
Yes, as a workaround, you can disable the CPPC feature in ACPI by modifying the system's BIOS settings. However, this may result in a loss of performance scaling capabilities for processors.
The updated Kernel version can be obtained from the official Linux Kernel repository. It is important to regularly update the Kernel to ensure the latest security fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
