CVE-2024-56662

What it actually does

Out-of-bounds read in acpi_nfit_ctl when accessing nd_cmd_pkg members including nd_reserved2 without verifying buf_len >= sizeof(struct nd_cmd_pkg), allowing vmalloc memory corruption via undersized call_pkg buffers.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory disclosure or crashes, risking sensitive data exposure and operational disruption; low exploit likelihood but requires prompt kernel updates across server and desktop fleets.

How an attack unfolds

An attacker invokes ND_CMD ioctls with a deliberately undersized buffer for struct nd_cmd_pkg, bypassing prior size validation in acpi_nfit_ctl so cmd_to_func performs an out-of-bounds read on vmalloc memory; no named actors observed exploiting this specific flaw.

How to fix it

Upgrade to Linux kernel commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; rebuild and deploy the patched kernel image, then reboot affected systems.

How to confirm the fix worked

Confirm presence of the buf != NULL && buf_len < sizeof(*call_pkg) check in drivers/acpi/nfit/core.c; test with syzbot-style undersized ND_CMD buffers to verify no KASAN report occurs.

Typical attack path

1. Locate Linux kernel exposing /dev/nfit or ACPI NFIT devices
2. Craft ND_CMD call with buf_len smaller than sizeof(struct nd_cmd_pkg)
3. Issue ioctl to trigger acpi_nfit_ctl without size guard
4. Read leaked kernel memory or induce KASAN crash

How to detect it

Search kernel logs for KASAN vmalloc-out-of-bounds reports citing acpi_nfit_ctl or cmd_to_func; inspect audit trails for unusual ND_CMD ioctls from untrusted processes.

What your security team should do

• Prioritize kernel upgrade within 30 days given memory corruption class
• Audit systems for custom NFIT or persistent memory configurations
• Enable KASAN or similar sanitizers in test environments to catch regressions
• Monitor vendor advisories for backported fixes in distribution kernels