CVE-2024-38667

What it actually does

Stack reservation for pt_regs is missing on secondary RISC-V idle threads, causing overlap that corrupts the pt_regs structure (including status field) when registers are stored on stack, leading to invalid vector context handling.

Why it matters to the business

RISC-V Linux systems may experience kernel instability or crashes during CPU hotplug or multi-hart boot scenarios, increasing downtime risk for embedded, server, and Android-derived devices until patched.

How an attack unfolds

An attacker with local access triggers CPU hotplug or secondary hart initialization; smp_callin stores registers onto the overlapping stack region, corrupting pt_regs and forcing the kernel to operate on a corrupted V context that can be leveraged for memory corruption primitives.

How to fix it

Update the Linux kernel to commit ea22d4195cca13d5fdbc4d6555a2dfb8a7867a9e or later; apply the equivalent backport that reserves task_pt_regs early for secondary harts.

How to confirm the fix worked

Verify the running kernel contains commit ea22d4195cca13d5fdbc4d6555a2dfb8a7867a9e; re-run CPU hotplug stress tests with vector extensions enabled and confirm no pt_regs corruption occurs.

Typical attack path

1. Obtain local code execution on a RISC-V Linux system
2. Trigger CPU hotplug or secondary hart bring-up
3. Force smp_callin or similar stack operations that overlap pt_regs
4. Corrupt status and vector context fields to create exploitable kernel state
5. Escalate to arbitrary code execution or denial of service

How to detect it

Review kernel logs for oops or warnings mentioning pt_regs, smp_callin, or vector context corruption during CPU hotplug events; correlate with process activity on secondary harts.

What your security team should do

• Prioritize patching RISC-V systems that perform CPU hotplug or multi-hart boot
• Monitor for kernel oops or vector context errors on affected hardware
• Restrict local unprivileged access on RISC-V devices until updated