CVE-2024-56662

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl

Fix an issue detected by syzbot with KASAN:

BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/

core.c:416 [inline]

BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0

drivers/acpi/nfit/core.c:459

The issue occurs in cmd_to_func when the call_pkg->nd_reserved2

array is accessed without verifying that call_pkg points to a buffer

that is appropriately sized as a struct nd_cmd_pkg. This can lead

to out-of-bounds access and undefined behavior if the buffer does not

have sufficient space.

To address this, a check was added in acpi_nfit_ctl() to ensure that

buf is not NULL and that buf_len is less than sizeof(*call_pkg)

before accessing it. This ensures safe access to the members of

call_pkg, including the nd_reserved2 array.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References