CVE-2024-46774 Details
Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution.
A vulnerability allowing the construction of Spectre v1 gadgets has been identified in the Linux kernel's powerpc architecture, specifically within the RTAS (Run-Time Abstraction Services) handling. This issue arises in the sys_rtas() function, where user-supplied data can be exploited to create speculative execution vulnerabilities. The 'nargs' and 'nret' variables, derived from user input, are used as indexes for a stack-based array and as parameters for the copy_to_user() function, following bounds checks. The vulnerability has been addressed by incorporating the array_index_nospec() function to sanitize these values, preventing their misuse in speculative execution.
Users can upgrade to the patched version of the Linux kernel available in the Debian 11 (bullseye) repository to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 29, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | < 6.10.10 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 3, 2025 | CVE Modified | CVE |
| May 2, 2025 | CVE Modified | kernel.org |
| Apr 25, 2025 | CVE Modified | kernel.org |
| Nov 20, 2024 | Initial Analysis | [email protected] |
| Sep 18, 2024 | New CVE Received | kernel.org |