CVE-2024-49886: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-49886 affects the Linux kernel's platform/x86 ISST (Intel Speed Select Technology) interface. The vulnerability was discovered when attaching SST PCI device to VM, which causes a 'BUG: KASAN: slab-out-of-bounds' error. The issue affects multiple Linux kernel versions including 5.15.115 through 5.15.168, 6.0 through 6.1.113, 6.2 through 6.6.55, 6.7 through 6.10.14, and 6.11 through 6.11.3 (NVD).

The vulnerability stems from a bug in the isstifgetpcidev function where physicalpackageids assigned by VMware VMM are not continuous and have gaps. This causes the value returned by topologyphysicalpackageid() to exceed topologymaxpackages(), leading to a slab-out-of-bounds read of size 8. The CVSS v3.1 base score is 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can cause a denial of service (system crash) when exploited. The bug occurs in the kernel's ISST interface when handling CPU topology information, specifically affecting systems using VMware virtualization (Kernel Patch).

The issue has been fixed by replacing topologyphysicalpackageid() with topologylogicalpackageid() and adding a boundary check against topologymaxpackages(). The fix has been incorporated into various Linux kernel versions through patches. Users should update to the latest kernel version that includes the fix (Kernel Patch).