In the Linux kernel, the following vulnerability has been resolved:
ACPI: PRM: Find EFIMEMORYRUNTIME block for PRM handler and context
PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services.
The issue arises because the PRMT is finding a block of type EFICONVENTIONALMEMORY, which is not appropriate for runtime services as described in Section 2.2.2 (Runtime Services) of the UEFI Specification [1]. Since the PRM handler is a type of runtime service, this causes an exception when the PRM handler is called.
[Firmware Bug]: Unable to handle paging request in EFI runtime service
WARNING: CPU: 22 PID: 4330 at drivers/firmware/efi/runtime-wrappers.c:341
__efi_queue_work+0x11c/0x170
Call trace:
Let PRMT find a block with EFIMEMORYRUNTIME for PRM handler and PRM context.
If no suitable block is found, a warning message will be printed, but the procedure continues to manage the next PRM handler.
However, if the PRM handler is actually called without proper allocation, it would result in a failure during error handling.
By using the correct memory types for runtime services, ensure that the PRM handler and the context are properly mapped in the virtual address space during runtime, preventing the paging request error.
The issue is really that only memory that has been remapped for runtime by the firmware can be used by the PRM handler, and so the region needs to have the EFIMEMORYRUNTIME attribute.
[ rjw: Subject and changelog edits ]
[ { "signature_type": "Line", "id": "CVE-2024-50141-0677399b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@088984c8d54c0053fc4ae606981291d741c5924b", "signature_version": "v1", "target": { "file": "drivers/acpi/prmt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "211562605173190977519795696139713821105", "33694743974019246113153926399739281499", "8502598921696341528369860139744911658", "52888907820482840728167910759352195477", "64831062791167223849905100879956885605", "286280494025387839754847891369615509015", "247278567482075024061890135576225153262", "304989917393458056658796710743566838138", "302863533230916654998088045764648471115", "280233976263096286862561011657395285784", "55203225706716997326533869858993178599", "34617900263922025974586324825351803551", "18240622832805663500355151403333725109", "55030412607904999274867699243474442771", "246234626053924092211775890239774773578", "264520643601795853889411368347662502143", "214168225819921087564228959422085669106", "16613425717182961143149600289561795421", "245810455809552944715749367933318842417", "274654702272124511816847954283159900960", "244676017811845213810343418371025245461" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50141-0872e347", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20e9fafb8bb6f545667d7916b0e81e68c0748810", "signature_version": "v1", "target": { "file": "drivers/acpi/prmt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "211562605173190977519795696139713821105", "33694743974019246113153926399739281499", "8502598921696341528369860139744911658", "52888907820482840728167910759352195477", "64831062791167223849905100879956885605", "286280494025387839754847891369615509015", "247278567482075024061890135576225153262", "304989917393458056658796710743566838138", "302863533230916654998088045764648471115", "280233976263096286862561011657395285784", "55203225706716997326533869858993178599", "34617900263922025974586324825351803551", "18240622832805663500355151403333725109", "55030412607904999274867699243474442771", "246234626053924092211775890239774773578", "264520643601795853889411368347662502143", "214168225819921087564228959422085669106", "16613425717182961143149600289561795421", "245810455809552944715749367933318842417", "274654702272124511816847954283159900960", "244676017811845213810343418371025245461" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-17e45ca2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ce081ad842510f0e70fa6065a401660eac876d4", "signature_version": "v1", "target": { "function": "acpi_parse_prmt", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "85899497410016240459336561269996155740", "length": 1900.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-1f86ce85", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795b080d9aa127215a5baf088a22fa09341a0126", "signature_version": "v1", "target": { "function": "efi_pa_va_lookup", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "146184831053472269167992468370763082362", "length": 316.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-30b2c1df", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@088984c8d54c0053fc4ae606981291d741c5924b", "signature_version": "v1", "target": { "function": "acpi_platformrt_space_handler", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "280777148354556552351414612406150877558", "length": 1647.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-38a11447", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@088984c8d54c0053fc4ae606981291d741c5924b", "signature_version": "v1", "target": { "function": "acpi_parse_prmt", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "85899497410016240459336561269996155740", "length": 1900.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-3fbf637f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df52929530839e878e6912e33348b54101e3250", "signature_version": "v1", "target": { "function": "acpi_platformrt_space_handler", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "324195735669330520992573656458382990890", "length": 1646.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50141-402b83eb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795b080d9aa127215a5baf088a22fa09341a0126", "signature_version": "v1", "target": { "file": "drivers/acpi/prmt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "150442944104309926999242540049320167790", "199509248538852148596345604990927187190", "8502598921696341528369860139744911658", "52888907820482840728167910759352195477", "64831062791167223849905100879956885605", "286280494025387839754847891369615509015", "247278567482075024061890135576225153262", "304989917393458056658796710743566838138", "302863533230916654998088045764648471115", "280233976263096286862561011657395285784", "55203225706716997326533869858993178599", "34617900263922025974586324825351803551", "18240622832805663500355151403333725109", "55030412607904999274867699243474442771", "246234626053924092211775890239774773578", "264520643601795853889411368347662502143", "214168225819921087564228959422085669106", "16613425717182961143149600289561795421", "245810455809552944715749367933318842417", "274654702272124511816847954283159900960", "244676017811845213810343418371025245461" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-6ece5afd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20e9fafb8bb6f545667d7916b0e81e68c0748810", "signature_version": "v1", "target": { "function": "acpi_platformrt_space_handler", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "280777148354556552351414612406150877558", "length": 1647.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-6f292f4a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795b080d9aa127215a5baf088a22fa09341a0126", "signature_version": "v1", "target": { "function": "acpi_parse_prmt", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "85899497410016240459336561269996155740", "length": 1900.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-746bc150", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ce081ad842510f0e70fa6065a401660eac876d4", "signature_version": "v1", "target": { "function": "acpi_platformrt_space_handler", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "324195735669330520992573656458382990890", "length": 1646.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-8b7c43e5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795b080d9aa127215a5baf088a22fa09341a0126", "signature_version": "v1", "target": { "function": "acpi_platformrt_space_handler", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "280777148354556552351414612406150877558", "length": 1647.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-8d688a7b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ce081ad842510f0e70fa6065a401660eac876d4", "signature_version": "v1", "target": { "function": "efi_pa_va_lookup", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "146184831053472269167992468370763082362", "length": 316.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-94804797", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20e9fafb8bb6f545667d7916b0e81e68c0748810", "signature_version": "v1", "target": { "function": "acpi_parse_prmt", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "85899497410016240459336561269996155740", "length": 1900.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-ab34b66f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df52929530839e878e6912e33348b54101e3250", "signature_version": "v1", "target": { "function": "efi_pa_va_lookup", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "146184831053472269167992468370763082362", "length": 316.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-b9e99aca", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@088984c8d54c0053fc4ae606981291d741c5924b", "signature_version": "v1", "target": { "function": "efi_pa_va_lookup", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "146184831053472269167992468370763082362", "length": 316.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-d41caa80", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df52929530839e878e6912e33348b54101e3250", "signature_version": "v1", "target": { "function": "acpi_parse_prmt", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "139208734533410370586018442067930059798", "length": 1568.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50141-e0fb882e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ce081ad842510f0e70fa6065a401660eac876d4", "signature_version": "v1", "target": { "file": "drivers/acpi/prmt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "150442944104309926999242540049320167790", "199509248538852148596345604990927187190", "8502598921696341528369860139744911658", "52888907820482840728167910759352195477", "64831062791167223849905100879956885605", "286280494025387839754847891369615509015", "247278567482075024061890135576225153262", "304989917393458056658796710743566838138", "302863533230916654998088045764648471115", "280233976263096286862561011657395285784", "55203225706716997326533869858993178599", "34617900263922025974586324825351803551", "18240622832805663500355151403333725109", "55030412607904999274867699243474442771", "246234626053924092211775890239774773578", "264520643601795853889411368347662502143", "214168225819921087564228959422085669106", "16613425717182961143149600289561795421", "245810455809552944715749367933318842417", "274654702272124511816847954283159900960", "244676017811845213810343418371025245461" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50141-ef9b2099", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20e9fafb8bb6f545667d7916b0e81e68c0748810", "signature_version": "v1", "target": { "function": "efi_pa_va_lookup", "file": "drivers/acpi/prmt.c" }, "digest": { "function_hash": "146184831053472269167992468370763082362", "length": 316.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50141-f78f3fd1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df52929530839e878e6912e33348b54101e3250", "signature_version": "v1", "target": { "file": "drivers/acpi/prmt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "150442944104309926999242540049320167790", "199509248538852148596345604990927187190", "8502598921696341528369860139744911658", "52888907820482840728167910759352195477", "64831062791167223849905100879956885605", "286280494025387839754847891369615509015", "247278567482075024061890135576225153262", "304989917393458056658796710743566838138", "302863533230916654998088045764648471115", "280233976263096286862561011657395285784", "55203225706716997326533869858993178599", "34617900263922025974586324825351803551", "18240622832805663500355151403333725109", "55030412607904999274867699243474442771", "246234626053924092211775890239774773578", "264520643601795853889411368347662502143", "214168225819921087564228959422085669106", "106228965691119120980877982022139857665", "245810455809552944715749367933318842417", "274654702272124511816847954283159900960", "244676017811845213810343418371025245461" ] }, "deprecated": false } ]