Junglewise Threat Intelligence

CVE-2024-26988: Linux Kernel out-of-bounds write in setup_command_line

CVE-2024-26988 · Severity: high · CVSS 7.8 · Published 2024-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's initialization process could allow for a memory overflow during system startup. The kernel incorrectly calculates the amount of memory needed to store system startup commands, which could lead to memory corruption. If exploited, this could allow a local user to compromise the integrity of the operating system or cause a system crash.

Technical details

An out-of-bounds write vulnerability exists in the 'setup_command_line' function within 'init/main.c' of the Linux kernel. The root cause is a calculation error where the kernel allocates memory based on the length of 'boot_command_line' but subsequently copies 'command_line' into that buffer. If 'command_line' is longer than 'boot_command_line', a heap-based buffer overflow occurs. This is a regression introduced by a previous commit that mis-consolidated string length checks. An attacker with local access could potentially leverage this overflow to corrupt kernel memory during the boot process. Patches have been released for multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.8.y.

Affected products

  • Linux Linux Kernel 5.1 to 5.10.216, 5.11 to 5.15.157, 5.16 to 6.1.88, 6.2 to 6.6.29, 6.7 to 6.8.8

Timeline

  • 2024-04-12: disclosed: Initial patch submitted by Yuntao Wang
  • 2024-05-01: advisory: CVE-2024-26988 published

References

Related threats