In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
Smatch warns:
arch/powerpc/kernel/rtas.c:1932 _dosys_rtas() warn: potential spectre issue 'args.args' [r] (local cap)
The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copytouser() after they are subject to bounds checks.
Use arrayindexnospec() after the bounds checks to clamp these values for speculative execution.
[
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"117061540458502978226021353847008450185",
"38664397903050366240250113124846771475",
"249529226863844397044835663141336693055",
"190916402703427029026909792493492796055",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0974d03eb479384466d828d65637814bee6b26d7",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-1a2f0830"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1625.0,
"function_hash": "227096290532015087117812026939318046935"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a262c2dc833f2fe1bd5c53a4d899e7077d3b1da9",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-3d5875b0"
},
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"117061540458502978226021353847008450185",
"38664397903050366240250113124846771475",
"249529226863844397044835663141336693055",
"190916402703427029026909792493492796055",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68d8156480940b79227d58865ec5d2947b9384a8",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-405ec980"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1616.0,
"function_hash": "223262862073201424691824669126206030257"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2834ff1d9641a8695a09ea79cd901c7b6d4d05f",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-51c3a1fb"
},
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"234178536011860589162588776072517748193",
"269397585518943774619246192853311285230",
"35142650357276686480193198380301091951",
"65359201585613952704466589300912458643",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1feff02e9da0dd0cdb195c428c42b5f9b6c771",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-59a43b8b"
},
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"46304460520367028942530446349511792605",
"164735354015385655943880950842597548631",
"26966634060272194930043146909142220936",
"188646834635791795820850869279003786658",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2834ff1d9641a8695a09ea79cd901c7b6d4d05f",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-75af2df0"
},
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"210105100714043393132753234478541399899",
"55506001346850484003550351797465199719",
"32561140137441353565682376468454929567",
"107383514317636928265724306251499194772",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b137af795399d8b657bad1646c18561530f35ed1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-75ce6f45"
},
{
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"46304460520367028942530446349511792605",
"164735354015385655943880950842597548631",
"26966634060272194930043146909142220936",
"188646834635791795820850869279003786658",
"276198107666432415289477615813108352889",
"211242009451719067135579792682729380254",
"221131957656426454304932482996805759343"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a262c2dc833f2fe1bd5c53a4d899e7077d3b1da9",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-46774-97f8dbc8"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1783.0,
"function_hash": "68988983204434150434217211881906049624"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b137af795399d8b657bad1646c18561530f35ed1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-b563fd04"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1831.0,
"function_hash": "130980667980114342871511553645850599697"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1feff02e9da0dd0cdb195c428c42b5f9b6c771",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-c14517e9"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1946.0,
"function_hash": "325666815806078184000630999491820543188"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0974d03eb479384466d828d65637814bee6b26d7",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-dbac901d"
},
{
"target": {
"function": "SYSCALL_DEFINE1",
"file": "arch/powerpc/kernel/rtas.c"
},
"signature_version": "v1",
"digest": {
"length": 1946.0,
"function_hash": "325666815806078184000630999491820543188"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68d8156480940b79227d58865ec5d2947b9384a8",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-46774-e6e0f807"
}
]