Executive brief
A vulnerability was identified in the Linux kernel's file handling system. This flaw could allow a local user to access small amounts of sensitive information from the computer's memory that should otherwise be protected. While the risk of a full system takeover is low, such leaks can sometimes be used to bypass other security protections.
Technical details
A kernel information leak exists in the do_sys_name_to_handle() function within fs/fhandle.c. The vulnerability stems from the use of kmalloc() to allocate memory for a file handle structure, which does not initialize the allocated memory. When this structure is subsequently copied to user space via copy_to_user(), uninitialized bytes (specifically bytes 18-19 in reported cases) are leaked. A local attacker can exploit this to read small fragments of kernel memory. The issue has been resolved by replacing kmalloc() with kzalloc() to ensure the memory is zero-initialized before being processed.
Affected products
- Linux Linux kernel 2.6.39 to 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2
Timeline
- 2024-01-19: disclosed: Initial patch submitted by Nikita Zhandarovich
- 2024-04-17: advisory: CVE-2024-26901 published
References
- https://git.kernel.org/stable/c/3948abaa4e2be938ccdfc289385a27342fb13d43
- https://git.kernel.org/stable/c/423b6bdf19bbc5e1f7e7461045099917378f7e71
- https://git.kernel.org/stable/c/4bac28f441e3cc9d3f1a84c8d023228a68d8a7c1
- https://git.kernel.org/stable/c/772a7def9868091da3bcb0d6c6ff9f0c03d7fa8b
- https://git.kernel.org/stable/c/bf9ec1b24ab4e94345aa1c60811dd329f069c38b
- https://git.kernel.org/stable/c/c1362eae861db28b1608b9dc23e49634fe87b63b
- https://git.kernel.org/stable/c/cba138f1ef37ec6f961baeab62f312dedc7cf730