In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Use accesswidth over bitwidth for system memory accesses
To align with ACPI 6.3+, since bit_width can be any 8-bit value, it cannot be depended on to be always on a clean 8b boundary. This was uncovered on the Cobalt 100 platform.
SError Interrupt on CPU26, code 0xbe000011 -- SError CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1 Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : cppcgetperfcaps+0xec/0x410 lr : cppcgetperfcaps+0xe8/0x410 sp : ffff8000155ab730 x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078 x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000 x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008 x14: ffffffffffffffff x13: ffff013f1fd63300 x12: 0000000000000006 x11: ffffdc7e128f4420 x10: 0000000000000000 x9 : ffffdc7e111badec x8 : ffff00802b251980 x7 : 0000000000000000 x6 : ffff0080139d0028 x5 : 0000000000000000 x4 : ffff0080139d0018 x3 : 00000000ffffffff x2 : 0000000000000008 x1 : ffff8000155ab7a0 x0 : 0000000000000000 Kernel panic - not syncing: Asynchronous SError Interrupt CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1 Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION Call trace: dumpbacktrace+0x0/0x1e0 showstack+0x24/0x30 dumpstacklvl+0x8c/0xb8 dumpstack+0x18/0x34 panic+0x16c/0x384 addtaint+0x0/0xc0 arm64serrorpanic+0x7c/0x90 arm64isfatalrasserror+0x34/0xa4 doserror+0x50/0x6c el1h64errorhandler+0x40/0x74 el1h64error+0x7c/0x80 cppcgetperfcaps+0xec/0x410 cppccpufreqcpuinit+0x74/0x400 [cppccpufreq] cpufreqonline+0x2dc/0xa30 cpufreqadddev+0xc0/0xd4 subsysinterfaceregister+0x134/0x14c cpufreqregisterdriver+0x1b0/0x354 cppccpufreqinit+0x1a8/0x1000 [cppccpufreq] dooneinitcall+0x50/0x250 doinitmodule+0x60/0x27c loadmodule+0x2300/0x2570 _dosysfinitmodule+0xa8/0x114 _arm64sysfinitmodule+0x2c/0x3c invokesyscall+0x78/0x100 el0svccommon.constprop.0+0x180/0x1a0 doel0svc+0x84/0xa0 el0svc+0x2c/0xc0 el0t64synchandler+0xa4/0x12c el0t64_sync+0x1a4/0x1a8
Instead, use accesswidth to determine the size and use the offset and width to shift and mask the bits to read/write out. Make sure to add a check for system memory since pcc redefines the accesswidth to subspace id.
If accesswidth is not set, then fall back to using bitwidth.
[ rjw: Subject and changelog edits, comment adjustments ]
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_write" }, "signature_version": "v1", "digest": { "length": 1267.0, "function_hash": "105176659036123650188257220507948347690" }, "id": "CVE-2024-35995-07143f2e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/acpi/cppc_acpi.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "92992001144526823706054115342309207613", "74846035647376868889323497698604042701", "205885028939442919915239936307916164961", "146430095498982584075550342977671687508", "252422053436228014506740760979061943214", "106123786434934454951345144494741831735", "190630697625253705169789928242442405724", "162491417121112771231044636016703423455", "8049374521369339567873321782619128621", "104896865847262061843834929231735192895", "276603870042902659065646829719477873379", "172614977393284648646793825958310227996", "134720727545491125527976732383142885318", "4766298200836712622749821772750505478", "140649301887594691770377237888363624523", "283223789406659640341010492585213796739", "170179221400225006248248704437419075307", "91210593125464066066903825114285760758", "234790636792696718070696648821666252109", "25808299918744882952971654696930247385", "264807632187852528174130004475323188919", "317675787111021222611385639959055732072", "178467587649774810750733202938126800292", "250191320801263580798164984910980537361", "155003164980901147001150906345678824941", "178327443904360597354496343969331364277", "62378878556978211204082745934295142380", "24499985401465140393579665153642094272", "11554221006277514102869682145629700275", "275496861926952076924399824289041143603", "137721272460122048369811939674190101606", "32887010728908901206973153364884624445", "200895305057278325826333321197212936899", "33842667208191978649925134366329287569", "118867026564891140814102751379149547495", "118801923185323440755627377137933200258", "215096045602865289138450442175490621973", "99296577676822262217080834416415728612", "256684245329640290449939996886606299615", "287413515742010606123513878765100609011" ], "threshold": 0.9 }, "id": "CVE-2024-35995-11faac36", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b890ae474d19800a6be1696df7fb4d9a41676e4" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/acpi/cppc_acpi.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "92992001144526823706054115342309207613", "74846035647376868889323497698604042701", "205885028939442919915239936307916164961", "146430095498982584075550342977671687508", "252422053436228014506740760979061943214", "106123786434934454951345144494741831735", "190630697625253705169789928242442405724", "162491417121112771231044636016703423455", "8049374521369339567873321782619128621", "104896865847262061843834929231735192895", "276603870042902659065646829719477873379", "172614977393284648646793825958310227996", "134720727545491125527976732383142885318", "4766298200836712622749821772750505478", "140649301887594691770377237888363624523", "283223789406659640341010492585213796739", "170179221400225006248248704437419075307", "91210593125464066066903825114285760758", "234790636792696718070696648821666252109", "25808299918744882952971654696930247385", "264807632187852528174130004475323188919", "317675787111021222611385639959055732072", "178467587649774810750733202938126800292", "250191320801263580798164984910980537361", "155003164980901147001150906345678824941", "178327443904360597354496343969331364277", "62378878556978211204082745934295142380", "24499985401465140393579665153642094272", "11554221006277514102869682145629700275", "275496861926952076924399824289041143603", "137721272460122048369811939674190101606", "32887010728908901206973153364884624445", "200895305057278325826333321197212936899", "33842667208191978649925134366329287569", "118867026564891140814102751379149547495", "118801923185323440755627377137933200258", "215096045602865289138450442175490621973", "99296577676822262217080834416415728612", "256684245329640290449939996886606299615", "287413515742010606123513878765100609011" ], "threshold": 0.9 }, "id": "CVE-2024-35995-1cb0da26", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f4a4d63a193be6fd530d180bb13c3592052904c" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_write" }, "signature_version": "v1", "digest": { "length": 1267.0, "function_hash": "105176659036123650188257220507948347690" }, "id": "CVE-2024-35995-2956e695", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b890ae474d19800a6be1696df7fb4d9a41676e4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "acpi_cppc_processor_probe" }, "signature_version": "v1", "digest": { "length": 4991.0, "function_hash": "264484572670409880149250809493525394311" }, "id": "CVE-2024-35995-2d598008", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b890ae474d19800a6be1696df7fb4d9a41676e4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_read" }, "signature_version": "v1", "digest": { "length": 1384.0, "function_hash": "183850695972577462716538573765796092004" }, "id": "CVE-2024-35995-38de0f66", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f4a4d63a193be6fd530d180bb13c3592052904c" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/acpi/cppc_acpi.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "92992001144526823706054115342309207613", "74846035647376868889323497698604042701", "205885028939442919915239936307916164961", "146430095498982584075550342977671687508", "252422053436228014506740760979061943214", "106123786434934454951345144494741831735", "190630697625253705169789928242442405724", "162491417121112771231044636016703423455", "8049374521369339567873321782619128621", "104896865847262061843834929231735192895", "276603870042902659065646829719477873379", "172614977393284648646793825958310227996", "134720727545491125527976732383142885318", "4766298200836712622749821772750505478", "140649301887594691770377237888363624523", "283223789406659640341010492585213796739", "170179221400225006248248704437419075307", "91210593125464066066903825114285760758", "234790636792696718070696648821666252109", "25808299918744882952971654696930247385", "264807632187852528174130004475323188919", "317675787111021222611385639959055732072", "178467587649774810750733202938126800292", "250191320801263580798164984910980537361", "155003164980901147001150906345678824941", "178327443904360597354496343969331364277", "62378878556978211204082745934295142380", "24499985401465140393579665153642094272", "11554221006277514102869682145629700275", "275496861926952076924399824289041143603", "137721272460122048369811939674190101606", "32887010728908901206973153364884624445", "200895305057278325826333321197212936899", "33842667208191978649925134366329287569", "118867026564891140814102751379149547495", "118801923185323440755627377137933200258", "215096045602865289138450442175490621973", "99296577676822262217080834416415728612", "256684245329640290449939996886606299615", "287413515742010606123513878765100609011" ], "threshold": 0.9 }, "id": "CVE-2024-35995-4ffc1a7a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01fc53be672acae37e611c80cc0b4f3939584de3" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "acpi_cppc_processor_probe" }, "signature_version": "v1", "digest": { "length": 4991.0, "function_hash": "264484572670409880149250809493525394311" }, "id": "CVE-2024-35995-5cb60f7f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_read" }, "signature_version": "v1", "digest": { "length": 1384.0, "function_hash": "183850695972577462716538573765796092004" }, "id": "CVE-2024-35995-61b0046e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01fc53be672acae37e611c80cc0b4f3939584de3" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "acpi_cppc_processor_probe" }, "signature_version": "v1", "digest": { "length": 4991.0, "function_hash": "264484572670409880149250809493525394311" }, "id": "CVE-2024-35995-7df2291c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f4a4d63a193be6fd530d180bb13c3592052904c" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_read" }, "signature_version": "v1", "digest": { "length": 1384.0, "function_hash": "183850695972577462716538573765796092004" }, "id": "CVE-2024-35995-b129fcde", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b890ae474d19800a6be1696df7fb4d9a41676e4" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_read" }, "signature_version": "v1", "digest": { "length": 1384.0, "function_hash": "183850695972577462716538573765796092004" }, "id": "CVE-2024-35995-b3499379", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_write" }, "signature_version": "v1", "digest": { "length": 1267.0, "function_hash": "105176659036123650188257220507948347690" }, "id": "CVE-2024-35995-b90c5149", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01fc53be672acae37e611c80cc0b4f3939584de3" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "cpc_write" }, "signature_version": "v1", "digest": { "length": 1267.0, "function_hash": "105176659036123650188257220507948347690" }, "id": "CVE-2024-35995-be669395", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f4a4d63a193be6fd530d180bb13c3592052904c" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/acpi/cppc_acpi.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "92992001144526823706054115342309207613", "74846035647376868889323497698604042701", "205885028939442919915239936307916164961", "146430095498982584075550342977671687508", "252422053436228014506740760979061943214", "106123786434934454951345144494741831735", "190630697625253705169789928242442405724", "162491417121112771231044636016703423455", "8049374521369339567873321782619128621", "104896865847262061843834929231735192895", "276603870042902659065646829719477873379", "172614977393284648646793825958310227996", "134720727545491125527976732383142885318", "4766298200836712622749821772750505478", "140649301887594691770377237888363624523", "283223789406659640341010492585213796739", "170179221400225006248248704437419075307", "91210593125464066066903825114285760758", "234790636792696718070696648821666252109", "25808299918744882952971654696930247385", "264807632187852528174130004475323188919", "317675787111021222611385639959055732072", "178467587649774810750733202938126800292", "250191320801263580798164984910980537361", "155003164980901147001150906345678824941", "178327443904360597354496343969331364277", "62378878556978211204082745934295142380", "24499985401465140393579665153642094272", "11554221006277514102869682145629700275", "275496861926952076924399824289041143603", "137721272460122048369811939674190101606", "32887010728908901206973153364884624445", "200895305057278325826333321197212936899", "33842667208191978649925134366329287569", "118867026564891140814102751379149547495", "118801923185323440755627377137933200258", "215096045602865289138450442175490621973", "99296577676822262217080834416415728612", "256684245329640290449939996886606299615", "287413515742010606123513878765100609011" ], "threshold": 0.9 }, "id": "CVE-2024-35995-c7324021", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/acpi/cppc_acpi.c", "function": "acpi_cppc_processor_probe" }, "signature_version": "v1", "digest": { "length": 4991.0, "function_hash": "264484572670409880149250809493525394311" }, "id": "CVE-2024-35995-e8aed2f5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01fc53be672acae37e611c80cc0b4f3939584de3" } ] }