Executive brief
A vulnerability in the Linux kernel's TOMOYO security module could allow a local user to trigger a system warning or potentially cause a denial-of-service condition. By providing an excessively long input line without a newline character, a user can force the system to attempt a very large memory allocation. While the system typically handles these failures, the repeated attempts can clutter system logs with warnings or exhaust available memory resources.
Technical details
A vulnerability exists in the tomoyo_write_control() function within the TOMOYO LSM of the Linux kernel. The issue stems from the lack of proper bounds checking on input lines that do not contain a newline character, leading to unbounded memory allocation attempts via kzalloc(). An attacker with local access can provide a very long string to trigger a 'too large allocation' warning or cause the kernel to return -ENOMEM. The fix involves adding the __GFP_NOWARN flag to the allocation request to suppress the warning and relying on standard memory management to handle oversized requests. This prevents the syzbot-reported warning and potential log flooding.
Affected products
- Linux Linux Kernel up to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2024-12-16: disclosed: Initial patch submitted by Tetsuo Handa
- 2025-03-06: advisory: CVE-2024-58085 published
References
- https://git.kernel.org/stable/c/3df7546fc03b8f004eee0b9e3256369f7d096685
- https://git.kernel.org/stable/c/414705c0303350d139b1dc18f329fe47dfb642dd
- https://git.kernel.org/stable/c/a01c200fa7eb59da4d2dbbb48b61f4a0d196c09f
- https://git.kernel.org/stable/c/b2bd5857a0d6973ebbcb4d9831ddcaebbd257be1
- https://git.kernel.org/stable/c/c67efabddc73171c7771d3ffe4ffa1e503ee533e
- https://git.kernel.org/stable/c/c9382f380e8d09209b8e5c0def0545852168be25
- https://git.kernel.org/stable/c/f6b37b3e12de638753bce79a2858070b9c4a4ad3