Executive brief
A vulnerability in the Linux kernel's device event handling system could allow a local user to cause a system crash or potentially access sensitive memory. The issue occurs when the kernel processes specific hardware-related messages, leading to an out-of-bounds memory access. This could impact system stability and data confidentiality on affected Linux-based servers and workstations.
Technical details
An out-of-bounds (OOB) read/access vulnerability exists in the Linux kernel's 'zap_modalias_env' function within 'lib/kobject_uevent.c'. The root cause is an incorrect calculation of the memory block size during a 'memmove' operation when the 'MODALIAS' variable is not the last element in the environment parameter. A local attacker with low privileges could exploit this to trigger an OOB access, potentially leading to a denial of service (system crash) or information disclosure. The vulnerability has been addressed in multiple stable kernel branches by correcting the size calculation passed to 'memmove'.
Affected products
- Linux Linux Kernel 4.15 to 4.19.319, 4.20 to 5.4.281, 5.5 to 5.10.223, 5.11 to 5.15.164, 5.16 to 6.1.102, 6.2 to 6.6.43, 6.7 to 6.10.2
Timeline
- 2024-05-30: other: Initial patch authored
- 2024-08-17: disclosed: CVE published
- 2024-08-19: patched: Patches applied to stable kernel trees
References
- https://git.kernel.org/stable/c/57fe01d3d04276875c7e3a6dc763517fc05b8762
- https://git.kernel.org/stable/c/648d5490460d38436640da0812bf7f6351c150d2
- https://git.kernel.org/stable/c/68d63ace80b76395e7935687ecdb86421adc2168
- https://git.kernel.org/stable/c/81a15d28f32af01493ae8c5457e0d55314a4167d
- https://git.kernel.org/stable/c/b59a5e86a3934f1b6a5bd1368902dbc79bdecc90
- https://git.kernel.org/stable/c/c5ee8adc8d98a49703320d13878ba2b923b142f5
- https://git.kernel.org/stable/c/d4663536754defff75ff1eca0aaebc41da165a8d