CVE-2024-46774

powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()

State: Published
Severity: Not scored
Published: Sep 18, 2024
Updated: May 11, 2026
Reserved: Sep 11, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()

Smatch warns:

arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap)

The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks.

Use array_index_nospec() after the bounds checks to clamp these values for speculative execution.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2834ff1d9641a8695a09ea79cd901c7b6d4d05fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a262c2dc833f2fe1bd5c53a4d899e7077d3b1da9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b137af795399d8b657bad1646c18561530f35ed1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f1feff02e9da0dd0cdb195c428c42b5f9b6c771Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 68d8156480940b79227d58865ec5d2947b9384a8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0974d03eb479384466d828d65637814bee6b26d7Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.135 through 6.1.Not affected 6.6.88 through 6.6.Not affected 6.10.10 through 6.10.*Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2834ff1d9641a8695a09ea79cd901c7b6d4d05fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a262c2dc833f2fe1bd5c53a4d899e7077d3b1da9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b137af795399d8b657bad1646c18561530f35ed1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1f1feff02e9da0dd0cdb195c428c42b5f9b6c771Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 68d8156480940b79227d58865ec5d2947b9384a8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0974d03eb479384466d828d65637814bee6b26d7Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.135 through 6.1.*Not affected
6.6.88 through 6.6.*Not affected
6.10.10 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.