Junglewise Threat Intelligence

CVE-2024-47742: Linux Kernel path traversal in firmware_loader

CVE-2024-47742 · Severity: high · CVSS 7.8 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's firmware loading mechanism could allow a local attacker or a malicious hardware device to access sensitive files on the system. By using special file path characters, an attacker could trick the system into reading files it shouldn't, potentially leading to the theft of sensitive data or a full system compromise. This affects systems where firmware names are dynamically generated from external inputs.

Technical details

A path traversal vulnerability exists in the Linux kernel's firmware_loader component due to insufficient validation of firmware filenames. While most firmware names are hardcoded, certain codepaths (such as lpfc_sli4_request_firmware_update and module_flash_fw_schedule) construct filenames using strings provided by hardware devices or semi-privileged userspace via netlink commands. An attacker can provide a filename containing '..' path components to escape the intended firmware directory and read arbitrary files from the filesystem. The fix implements a check to reject any firmware names containing '..' components.

Affected products

  • Linux Linux Kernel 3.7 to 4.19.323, 4.20 to 5.4.285, 5.5 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.54, 6.7 to 6.10.13, 6.11 to 6.11.2

Timeline

  • 2024-08-28: other: Vulnerability reported by Jann Horn
  • 2024-10-04: patched: Fix committed to stable kernel branches
  • 2024-10-21: advisory: CVE-2024-47742 published

References

Related threats