Executive brief
A vulnerability in the Linux kernel's Trusted Platform Module (TPM) component could cause a system crash or instability. The issue occurs when the system attempts to allocate a large memory buffer for security logs provided by the computer's firmware (ACPI). If an attacker or a malfunctioning firmware provides an unexpectedly large log size, it can trigger a kernel warning or failure, potentially leading to a denial of service.
Technical details
A vulnerability exists in the TPM event log handling within the Linux kernel's ACPI implementation (`drivers/char/tpm/eventlog/acpi.c`). The issue stems from the use of `devm_kmalloc()`, which relies on `kmalloc()` and can fail or trigger kernel warnings when attempting to allocate large contiguous memory blocks (e.g., 16 MiB as reported on certain HPE hardware). An attacker with local access or a compromised ACPI table could specify a large log buffer size, causing an allocation failure in `__alloc_pages_noprof()`. The fix replaces `devm_kmalloc()` with `kvmalloc()`, which allows for non-contiguous (virtually contiguous) memory allocations, and implements manual cleanup via `devm_add_action()`.
Affected products
- Linux Linux Kernel 2.6.16 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2024-12-27: patched: Initial patch authored by Jarkko Sakkinen
- 2025-02-27: advisory: CVE-2024-58005 published
References
- https://git.kernel.org/stable/c/0621d2599d6e02d05c85d6bbd58eaea2f15b3503
- https://git.kernel.org/stable/c/422d7f4e8d817be467986589c7968d3ea402f7da
- https://git.kernel.org/stable/c/4c8bfe643bbd00b04ee8f9545ef33bf6a68c38db
- https://git.kernel.org/stable/c/50365a6304a57266e8f4d3078060743c3b7a1e0d
- https://git.kernel.org/stable/c/77779d1258a287f2c5c2c6aeae203e0996209c77
- https://git.kernel.org/stable/c/a3a860bc0fd6c07332e4911cf9a238d20de90173
- https://git.kernel.org/stable/c/a676c0401de59548a5bc1b7aaf98f556ae8ea6db