Junglewise Threat Intelligence

CVE-2024-58016: Linux Kernel SafeSetID missing size check in handle_policy_update

CVE-2024-58016 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SafeSetID security module could allow a local user to cause a system warning or potential instability. By sending an unexpectedly large amount of data to a specific system file, an attacker can trigger an error in the kernel's memory allocation process. This primarily impacts system availability and reliability rather than data confidentiality.

Technical details

A vulnerability exists in the Linux kernel's SafeSetID LSM (Linux Security Module) within the security/safesetid/securityfs.c component. The handle_policy_update() function, which processes writes to SafeSetID's securityfs entries, fails to validate the length of the input buffer before attempting memory allocation. A local attacker with sufficient privileges to write to these entries can provide a buffer size exceeding KMALLOC_MAX_SIZE, triggering a kernel warning in the kmalloc allocator. This is a resource management issue that can lead to a local Denial of Service (DoS) or system instability. The fix introduces a check to ensure the write length is within valid bounds before allocation.

Affected products

  • Linux Linux Kernel 5.1 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3

Timeline

  • 2024-12-17: other: Patch authored
  • 2025-02-26: advisory: CVE published by kernel.org
  • 2025-02-27: advisory: NVD published date

References

Related threats