acpica AmlParser OOB

Vulnerability analysis

The ACPI AML parser processes bytecode from firmware-supplied ACPI tables at boot and during runtime table loads. Two parser functions fail to verify that the current parsing position has not exceeded the end of the AML buffer before dereferencing pointers — one iterates past namestring prefix characters in an unbounded loop, and another reads opcode bytes without a boundary check. A malformed ACPI table can cause the parser to read kernel memory beyond the allocated buffer, leading to a kernel panic or potential information disclosure from adjacent heap data. The fix adds explicit boundary checks before each pointer dereference, causing the parser to return an error value and stop processing when the buffer end is reached. This vulnerability is only reachable by supplying a crafted ACPI table, which requires compromised firmware, physical access to modify the boot configuration, or root-level access to override ACPI tables via initrd or configfs.