Linux Kernel ACPI Suspend Vulnerability in Xen PV Guests

A vulnerability in the Linux kernel's ACPI suspend handling for Xen paravirtualized guests can lead to a null pointer dereference. This issue arises because a recent change intended to improve suspend handling missed a code path that accesses the real mode header, causing the kernel to dereference a null pointer during the suspend process. The vulnerability has been addressed by adding an optional ACPI callback to skip setting the wakeup address, allowing the hypervisor to manage it instead.

Impact

The vulnerability causes a kernel null pointer dereference, leading to a crash.

Reproduction

The vulnerability can be reproduced by suspending a system running as a Xen paravirtualized guest. During the suspend process, the kernel will attempt to access the real mode header, which has not been properly initialized, resulting in a null pointer dereference.