CVE-2024-40974

What it actually does

The hcall wrapper functions accept undersized result buffers via pointer parameters, allowing stores beyond the provided array bounds and resulting in stack corruption on powerpc platforms.

Why it matters to the business

Kernel instability or crashes on affected powerpc systems if developer code passes undersized buffers; low ecosystem prevalence reduces overall operational risk but still requires kernel updates on IBM pseries hardware.

How an attack unfolds

An attacker would need to trigger paths that invoke the hcall APIs with undersized result arrays, causing the hypervisor call wrappers to write results past the end of the stack buffer; no public exploitation or real-world instances have been identified.

How to fix it

Update the Linux kernel to commit acf2b80c31c37acab040baa3cf5f19fbd5140b18 or later; rebuild with -Warray-bounds enabled where possible to catch similar issues at compile time.

How to confirm the fix worked

Verify the running kernel contains commit acf2b80c31c37acab040baa3cf5f19fbd5140b18; inspect declarations of plpar_hcall, plpar_hcall9 and related functions for explicit array sizes instead of pointers.

Typical attack path

1. Identify or induce code paths calling plpar_hcall9 or similar with undersized retbuf arrays
2. Trigger the hcall so that result writes exceed the declared buffer size
3. Overwrite adjacent stack frames leading to corruption or control-flow hijack

How to detect it

Review kernel logs for unexpected stack corruption or oops messages involving hcall result handling on powerpc; examine source for any remaining undersized buffer usage around plpar_hcall functions.

What your security team should do

• Apply the fixed kernel commit on all powerpc pseries systems
• Enable compiler warnings for array bounds on supported toolchains
• Audit internal kernel modules or out-of-tree code that calls the affected hcall wrappers