CVE-2024-46774

What it actually does

User-controlled nargs and nret values from the rtas syscall buffer are used as array indexes and copy_to_user sizes after bounds checks but without speculation barriers, allowing Spectre v1 gadget construction on powerpc.

Why it matters to the business

Potential leakage of kernel memory contents via speculative execution side channels on affected PowerPC Linux systems; low exploitability reduces immediate operational risk but still requires patching of production kernels.

How an attack unfolds

An attacker invokes the rtas syscall with a crafted buffer supplying out-of-bounds nargs or nret values; under speculative execution the processor may index into the stack array or perform oversized copy_to_user before the architectural bounds check resolves, leaking data via cache side channels.

How to fix it

Apply the upstream fix commit d2834ff1d9641a8695a09ea79cd901c7b6d4d05f or later stable kernels containing array_index_nospec() usage after the nargs/nret bounds checks in arch/powerpc/kernel/rtas.c.

How to confirm the fix worked

Verify the presence of array_index_nospec() calls protecting nargs and nret in the __do_sys_rtas function; confirm via kernel source inspection or by running smatch/static analysis on the patched tree.

Typical attack path

1. Locate a reachable powerpc system exposing the rtas syscall
2. Craft a user buffer with nargs/nret values that pass static bounds checks but enable speculative out-of-bounds access
3. Trigger the syscall repeatedly while monitoring cache state to extract leaked kernel data
4. Use leaked information to bypass other protections or escalate privileges

How to detect it

Exploitation is speculative and leaves no reliable post-facto artifacts; review syscall audit logs for unusual rtas invocations with extreme nargs/nret values and correlate with cache-timing or performance-counter anomalies on powerpc hosts.

What your security team should do

• Prioritize patching PowerPC Linux kernels within standard maintenance windows given low EPSS and absence from KEV
• Audit any custom rtas userspace callers for similar index handling patterns
• Monitor for future Spectre v1 findings in other architecture-specific syscalls
• Update kernel build and test pipelines to include speculation-safety static checks