In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present. However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference. Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions.
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ACPICA: Revertir "ACPICA: evitar Información: mapeo de múltiples BAR. Su kernel está bien". Deshaga las modificaciones realizadas en el commit d410ee5109a1 ("ACPICA: evite "Información: mapeo de varias BAR. Su kernel está bien.""). El propósito inicial de esté commit fue evitar que las asignaciones de memoria para regiones de operación se superpongan en los límites de las páginas, ya que puede generar advertencias si hay diferentes atributos de página presentes. Sin embargo, se descubrió que cuando surge esta situación, el mapeo continúa hasta el final del límite, pero todavía hay un intento de leer/escribir en toda la longitud del mapa, lo que lleva a una deferencia del puntero NULL. Por ejemplo, si se realiza una solicitud de asignación de cuatro bytes pero solo se asigna un byte porque llega al final del límite de la página actual, aún se realiza un intento de lectura/escritura de cuatro bytes, lo que resulta en una deferencia de puntero NULL. En su lugar, asigne toda la longitud, ya que la especificación ACPI no exige que deba estar dentro del mismo límite de página. Está permitido mapearlo en diferentes regiones.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc0d080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc0c740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384d71a80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384d725c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc0cdc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbc0d400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384d72ac0> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd384d72d00> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd384d70400> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd2dbc0f040> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd3605f7d80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:* |