Junglewise Threat Intelligence

CVE-2024-50301: Linux Kernel slab-out-of-bounds read in key_task_permission

CVE-2024-50301 · Severity: high · CVSS 7.1 · Published 2024-11-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's security key management system could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system incorrectly processes specific patterns of security keys, leading to an 'out-of-bounds' memory read. This could impact the stability of the operating system and the confidentiality of data stored in the kernel's memory.

Technical details

An out-of-bounds read exists in the 'key_task_permission' function within 'security/keys/permission.c'. The root cause is a logic error in 'search_nested_keyrings' where a shortcut pointer in the root node of an associative array is mistakenly treated as a keyring pointer. This occurs because the 'KEYRING_PTR_SUBTYPE' bitmask overlaps with the 'ASSOC_ARRAY_PTR_SUBTYPE_MASK'. An attacker can trigger this by adding more than 32 keys with specific similar hashes to a keyring, causing the internal tree structure to split and create a shortcut at the root level. When the kernel later iterates through these slots, it performs an invalid memory access. The fix ensures that shortcut pointers are correctly identified and handled regardless of whether the node is a root node.

Affected products

  • Linux Linux Kernel 3.13 to 4.19.324, 4.20 to 5.4.286, 5.5 to 5.10.230, 5.11 to 5.15.172, 5.16 to 6.1.117, 6.2 to 6.6.61, 6.7 to 6.11.8

Timeline

  • 2024-11-19: advisory: NVD publication date
  • 2024-11-14: patched: Fix committed to stable kernel trees

References

Related threats