Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER section

Impact

ghes_handle_arm_hw_error() advanced past the cper_sec_proc_arm header with (err + 1) but reduced the remaining length by sizeof(err) - the pointer size - instead of sizeof(*err), the structure size. The remaining byte count is therefore overestimated, and when err_info_num is large relative to error_data_length the parser walks cper_arm_err_info records past the end of the CPER section. This code runs on ARM64 hosts when firmware reports a hardware error through APEI, so it fires during the exact event an operator depends on for accurate diagnosis - and on ARM-based GPU systems a hardware-error report from a marginal DIMM or device can push the kernel into reading unrelated memory as error records.

Who can reach it

Not tenant-reachable. The malformed input comes from platform firmware or a BMC generating the CPER records, so it requires firmware that reports an inconsistent err_info_num, or control over the error-record path. ARM64 hosts only.

What to do

Update to a stable kernel that uses sizeof(*err) so the length accounting matches the pointer advance, then reboot the affected ARM64 nodes. x86 hosts do not take this path. Where a node is already logging APEI ARM processor errors, treat the reboot as urgent rather than routine, since the faulty parse runs on every such report. The record lists four stable commits and no fixed version.

References

Related entries

• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored