Executive brief
A vulnerability was identified in the Linux kernel's logging system (printk) where a mathematical error in defining the maximum log buffer size could lead to unpredictable system behavior. This issue primarily affects the stability of the operating system, potentially allowing a local user to cause a system crash or denial of service. The flaw has been addressed in recent kernel updates to ensure the buffer size is calculated safely.
Technical details
A signed integer overflow vulnerability existed in kernel/printk/printk.c due to the bitwise shift operation '1 << 31' on a 32-bit signed integer. In C, shifting a 1 into the sign bit of a signed 32-bit integer results in undefined behavior. This constant is used to define LOG_BUF_LEN_MAX. An attacker with local access could potentially leverage this undefined behavior to impact system availability. The fix involves casting the integer literal to an unsigned 32-bit integer (u32) before the shift operation to ensure well-defined behavior. Patches have been backported to multiple stable kernel branches including 6.1.y, 6.6.y, 6.12.y, and 6.13.y.
Affected products
- Linux Linux Kernel versions before 6.1.129, 6.6.78, 6.12.14, 6.13.3
Timeline
- 2024-09-28: disclosed: Initial patch submitted by Kuan-Wei Chiu
- 2024-12-12: patched: Patch committed to main stable tree
- 2025-02-27: advisory: CVE-2024-58017 published
References
- https://git.kernel.org/stable/c/3d6f83df8ff2d5de84b50377e4f0d45e25311c7a
- https://git.kernel.org/stable/c/404e5fd918a0b14abec06c7eca128f04c9b98e41
- https://git.kernel.org/stable/c/4a2c4e7265b8eed83c25d86d702cea06493cab18
- https://git.kernel.org/stable/c/4acf6bab775dbd22a9a799030a808a7305e01d63
- https://git.kernel.org/stable/c/54c14022fa2ba427dc543455c2cf9225903a7174
- https://git.kernel.org/stable/c/9a6d43844de2479a3ff8d674c3e2a16172e01598
- https://git.kernel.org/stable/c/bb8ff054e19fe27f4e5eaac1b05e462894cfe9b1