Junglewise Threat Intelligence

CVE-2024-41000: Linux Kernel integer overflow in block/ioctl.c

CVE-2024-41000 · Severity: high · CVSS 7.8 · Published 2024-07-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's block device management system, which handles how the operating system interacts with storage hardware like hard drives and SSDs. A local attacker could exploit a mathematical error in how the system checks for data boundaries to potentially cause system instability or gain unauthorized access. This issue affects various versions of the Linux kernel and has been addressed in recent updates.

Technical details

An integer overflow vulnerability exists in 'block/ioctl.c' within the Linux kernel. The 'blkpg_do_ioctl' function performed an unsafe addition ('p.start + p.length < 0') to check for partition overflows, which could itself trigger a signed integer overflow when processing large values. This was identified using the Undefined Behavior Sanitizer (UBSAN). A local attacker with permissions to call IOCTLs on block devices could exploit this to bypass boundary checks. The fix replaces the direct addition with a subtraction-based check ('LLONG_MAX - p.length < p.start') to prevent the overflow from occurring during the validation logic itself. Patch versions include 5.10.221, 5.15.162, 6.1.96, 6.6.36, and 6.9.7.

Affected products

  • Linux Linux Kernel up to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7

Timeline

  • 2024-07-12: advisory: CVE published by NVD
  • 2024-05-07: patched: Initial patch submitted by Justin Stitt

References

Related threats