In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: Enforce hcall result buffer validity and size
plpar_hcall(), plpar_hcall9(), and related functions expect callers to
provide valid result buffers of certain minimum size. Currently this
is communicated only through comments in the code and the compiler has
no idea.
For example, if I write a bug like this:
long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE
plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
This compiles with no diagnostics emitted, but likely results in stack
corruption at runtime when plpar_hcall9() stores results past the end
of the array. (To be clear this is a contrived example and I have not
found a real instance yet.)
To make this class of error less likely, we can use explicitly-sized
array parameters instead of pointers in the declarations for the hcall
APIs. When compiled with -Warray-bounds[1], the code above now
provokes a diagnostic like this:
error: array argument is too small;
is of size 32, callee requires at least 72 [-Werror,-Warray-bounds]
60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,
| ^ ~~~~~~
[1] Enabled for LLVM builds but not GCC for now. See commit
0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and
related changes.
References
Configurations
Configuration 1 (hide)
|
History
17 Sep 2025, 14:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/19c166ee42cf16d8b156a6cb4544122d9a65d3ca - Patch | |
| References | () https://git.kernel.org/stable/c/262e942ff5a839b9e4f3302a8987928b0c8b8a2d - Patch | |
| References | () https://git.kernel.org/stable/c/3ad0034910a57aa88ed9976b1431b7b8c84e0048 - Patch | |
| References | () https://git.kernel.org/stable/c/8aa11aa001576bf3b00dcb8559564ad7a3113588 - Patch | |
| References | () https://git.kernel.org/stable/c/a8c988d752b3d98d5cc1e3929c519a55ef55426c - Patch | |
| References | () https://git.kernel.org/stable/c/aa6107dcc4ce9a3451f2d729204713783b657257 - Patch | |
| References | () https://git.kernel.org/stable/c/acf2b80c31c37acab040baa3cf5f19fbd5140b18 - Patch | |
| References | () https://git.kernel.org/stable/c/ff2e185cf73df480ec69675936c4ee75a445c3e4 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-787 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
Information
Published : 2024-07-12 13:15
Updated : 2025-09-17 14:46
NVD link : CVE-2024-40974
Mitre link : CVE-2024-40974
CVE.ORG link : CVE-2024-40974
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write