CVE-2024-47751

What it actually does

Incorrect bounds check in kirin_pcie_parse_port() allows out-of-bounds array access to gpio_id_reset when num_slots + 1 comparison fails, enabling buffer overflow.

Why it matters to the business

Local attackers may crash systems or execute arbitrary code on Linux devices using Kirin PCIe hardware, raising operational risk and potential data exposure.

How an attack unfolds

Attacker with local access supplies crafted PCIe port configuration that passes the flawed num_slots check, triggering the off-by-one increment and overflowing the array to corrupt adjacent memory for code execution; observed in broad zero-day campaigns by espionage and financially motivated actors targeting Linux kernel flaws.

How to fix it

Apply the upstream kernel patch that corrects the comparison to pcie->num_slots + 1 >= MAX_PCI_SLOTS and moves the increment; upgrade affected puma installations to version 5.6.7.

How to confirm the fix worked

Confirm kernel source contains the fixed condition and increment order; test PCIe initialization with MAX_PCI_SLOTS boundary values to verify no overflow occurs.

Typical attack path

1. Locate systems running vulnerable Linux kernel with Kirin PCIe driver
2. Trigger kirin_pcie_parse_port() via device enumeration or config manipulation
3. Supply num_slots value that evades the incorrect bounds test
4. Execute out-of-bounds write to achieve privilege escalation or denial of service

How to detect it

Review kernel logs for PCIe slot parsing errors or oops reports around device initialization; inspect for unexpected array accesses in kirin_pcie code paths; correlate with threat actor TTPs involving Linux kernel out-of-bounds writes.

What your security team should do

• Prioritize patching Linux kernels on all Kirin PCIe systems before the CISA due date if applicable
• Monitor EPSS trend and threat actor activity for any increase in exploitation attempts
• Restrict untrusted local access on affected endpoints until patches are deployed