Executive brief
A vulnerability in the Linux kernel's SafeSetID security module could allow a local user to cause a system warning or potential instability. By sending an unexpectedly large amount of data to a specific system file, an attacker can trigger an error in the kernel's memory allocation process. This primarily impacts system availability and reliability rather than data confidentiality.
Technical details
A vulnerability exists in the Linux kernel's SafeSetID LSM (Linux Security Module) within the security/safesetid/securityfs.c component. The handle_policy_update() function, which processes writes to SafeSetID's securityfs entries, fails to validate the length of the input buffer before attempting memory allocation. A local attacker with sufficient privileges to write to these entries can provide a buffer size exceeding KMALLOC_MAX_SIZE, triggering a kernel warning in the kmalloc allocator. This is a resource management issue that can lead to a local Denial of Service (DoS) or system instability. The fix introduces a check to ensure the write length is within valid bounds before allocation.
Affected products
- Linux Linux Kernel 5.1 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2024-12-17: other: Patch authored
- 2025-02-26: advisory: CVE published by kernel.org
- 2025-02-27: advisory: NVD published date
References
- https://git.kernel.org/stable/c/36b385d0f2b4c0bf41d491e19075ecd990d2bf94
- https://git.kernel.org/stable/c/96fae5bd1589731592d30b3953a90a77ef3928a6
- https://git.kernel.org/stable/c/976284b94f2021df09829e37a367e19b84d9e5f3
- https://git.kernel.org/stable/c/a0dec65f88c8d9290dfa1d2ca1e897abe54c5881
- https://git.kernel.org/stable/c/c71d35676d46090c891b6419f253fb92a1a9f4eb
- https://git.kernel.org/stable/c/ecf6a4a558097920447a6fb84dfdb279e2ac749a
- https://git.kernel.org/stable/c/f09ff307c7299392f1c88f763299e24bc99811c7