CVE-2024-49862

What it actually does

The vulnerability is an off-by-one error in get_rpi() that allows access beyond the end of the rpi_msr or rpi_tpmi arrays (each sized to NR_RAPL_PRIMITIVES), resulting in an out-of-bounds memory access.

Why it matters to the business

Systems running affected kernel versions may experience crashes, information leaks, or code execution in the power management subsystem; with thousands of downstream dependents the exposure affects broad Linux server and embedded deployments and requires prompt patching to meet operational uptime goals.

How an attack unfolds

An attacker with local access triggers the flawed comparison in get_rpi() to read or write one element past the array bounds, potentially corrupting adjacent kernel structures; campaigns by espionage and financially motivated actors as well as documented Linux kernel out-of-bounds read/write issues illustrate how this primitive can be chained into privilege escalation.

How to fix it

Update to a kernel containing the fix for the off-by-one comparison; for the carrierwave package apply the listed fixed versions (2.1.1 or 1.3.2) where the component is present in the build environment.

How to confirm the fix worked

Confirm the patched kernel source no longer uses '>' but '>=' for the rpi array bounds check; run regression tests exercising intel_rapl primitives and verify no out-of-bounds sanitizer reports occur.

Typical attack path

1. Obtain local code execution on target system
2. Invoke RAPL primitive lookup that exercises get_rpi()
3. Trigger the off-by-one array access to corrupt or leak kernel memory
4. Escalate to ring-0 control or exfiltrate data

How to detect it

Review kernel logs for oops or panic messages referencing intel_rapl or get_rpi; inspect system call traces involving RAPL MSR or TPMI accesses around the time of any unexpected power or thermal subsystem faults; correlate with known Linux kernel out-of-bounds access patterns reported by threat actors.

What your security team should do

• Prioritize kernel updates on all production Linux hosts within the next maintenance window
• Monitor EPSS and threat actor activity for any rise in exploitation attempts
• Add the supplied carrierwave fixed versions to dependency scanners and rebuild pipelines