In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix acpi_package_ids[] array overflow
With LoongArch virt machine, a typical setting is one core per socket,
there will max 256 sockets (packages) on one VM. With PPTT acpi table,
array acpi_package_ids[] will be overflowed.
Here change the array size of acpi_package_ids[] with the max value of
MAX_PACKAGES and KVM_MAX_VCPUS.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.4
AV:L - The overflow is in parse_acpi_topology(), called from loongson_prepare_cpus() during smp_prepare_cpus() as the kernel consumes the firmware or VMM ACPI PPTT table at boot; there is no network, adjacent-network, or USB path into this parser.
AC:L - A LoongArch virt machine with the typical one-core-per-socket layout can expose up to 256 packages (KVM_MAX_VCPUS) against acpi_package_ids[MAX_PACKAGES] (16 entries); each new PPTT package ID is stored via acpi_package_ids[acpi_nr_packages++] with no bounds check, so the overflow is deterministic with no race.
PR:N - PPTT is parsed automatically during SMP bring-up with no capable() check, Linux login, or syscall. A hypervisor-generated virt-machine table or supply-chain/evil-maid firmware with more than 16 unique packages triggers the write without any account or user-namespace privilege.
UI:N - The out-of-bounds write runs as part of ordinary kernel_init_freeable() SMP setup before userspace starts; no victim mount, file open, or other interactive action is required.
S:U - The write corrupts kernel BSS and related globals inside the same kernel that parsed PPTT. This is not a KVM guest-to-host escape, sandbox breakout, or IOMMU/DMA authority crossing.
C:H - Firmware-controlled 32-bit topology IDs are written past acpi_package_ids[] into adjacent kernel BSS, and the later canonicalization loop also reads past the array. Per memory-corruption guidance that is High confidentiality, not a bounded few-byte leak.
I:H - This is a direct out-of-bounds write of firmware-controlled ints past a 16-entry static array (up to hundreds of stores on large VMs). Out-of-bounds writes score High because they can smash adjacent BSS, including function pointers, and enable control-flow hijack.
A:H - Smashing kernel BSS during SMP bring-up can oops, panic, or prevent boot. Canonicalized package IDs >= MAX_PACKAGES also index loongson3_cpufreq's cpufreq_mutex[MAX_PACKAGES] out of bounds, causing further crashes.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The overflow is in parse_acpi_topology(), called from loongson_prepare_cpus() during smp_prepare_cpus() as the kernel consumes the firmware or VMM ACPI PPTT table at boot; there is no network, adjacent-network, or USB path into this parser.
AC:L - A LoongArch virt machine with the typical one-core-per-socket layout can expose up to 256 packages (KVM_MAX_VCPUS) against acpi_package_ids[MAX_PACKAGES] (16 entries); each new PPTT package ID is stored via acpi_package_ids[acpi_nr_packages++] with no bounds check, so the overflow is deterministic with no race.
PR:N - PPTT is parsed automatically during SMP bring-up with no capable() check, Linux login, or syscall. A hypervisor-generated virt-machine table or supply-chain/evil-maid firmware with more than 16 unique packages triggers the write without any account or user-namespace privilege.
UI:N - The out-of-bounds write runs as part of ordinary kernel_init_freeable() SMP setup before userspace starts; no victim mount, file open, or other interactive action is required.
S:U - The write corrupts kernel BSS and related globals inside the same kernel that parsed PPTT. This is not a KVM guest-to-host escape, sandbox breakout, or IOMMU/DMA authority crossing.
C:H - Firmware-controlled 32-bit topology IDs are written past acpi_package_ids[] into adjacent kernel BSS, and the later canonicalization loop also reads past the array. Per memory-corruption guidance that is High confidentiality, not a bounded few-byte leak.
I:H - This is a direct out-of-bounds write of firmware-controlled ints past a 16-entry static array (up to hundreds of stores on large VMs). Out-of-bounds writes score High because they can smash adjacent BSS, including function pointers, and enable control-flow hijack.
A:H - Smashing kernel BSS during SMP bring-up can oops, panic, or prevent boot. Canonicalized package IDs >= MAX_PACKAGES also index loongson3_cpufreq's cpufreq_mutex[MAX_PACKAGES] out of bounds, causing further crashes.
CVSS 3.1