In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate level in perf mask ioctls
isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the
user-provided level as an index into perf_levels[] via
_read_pp_level_info() and _read_bf_level_info(), but neither helper
validates it first. The adjacent level-info helpers reject levels above max_level before
reading the same per-level register block. Add the same bounds checks to
the mask helpers, and reject disabled SST-PP levels in
isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
This prevents out-of-bounds reads from the per-level offset table on
invalid ioctl input.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 5
https://git.kernel.org/stable/c/1889a9156553f0692acd57caf15e877baace1a01
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1a8bab5ceee1a42a78de12d3d69f67516a20588e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/80e0d353c86a9a168ad6d213f494796294381538
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d19385624bdfb577db9c94bb8879992fd5e17bcd
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68
416baaa9-dc9f-4396-8d5f-8c081fb06d67