irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value. Currently, the get_logical_index() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a per_cpu variable array. Add a check to evaluate get_logical_index() return value.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 35866efa52feaf48cc54a0745851a555654e1446 · fixed in 6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69; From 35866efa52feaf48cc54a0745851a555654e1446 · fixed in 328affc639ce9873a7a0a3fd6b8339f19767529b
- Linux Linux
7.0
- KernelLinux
From 7.0.0 · fixed in 7.2.6