Junglewise Threat Intelligence

CVE-2024-58085: Linux Kernel TOMOYO denial of service in tomoyo_write_control

CVE-2024-58085 · Severity: medium · CVSS 5.5 · Published 2025-03-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's TOMOYO security module could allow a local user to trigger a system warning or potentially cause a denial-of-service condition. By providing an excessively long input line without a newline character, a user can force the system to attempt a very large memory allocation. While the system typically handles these failures, the repeated attempts can clutter system logs with warnings or exhaust available memory resources.

Technical details

A vulnerability exists in the tomoyo_write_control() function within the TOMOYO LSM of the Linux kernel. The issue stems from the lack of proper bounds checking on input lines that do not contain a newline character, leading to unbounded memory allocation attempts via kzalloc(). An attacker with local access can provide a very long string to trigger a 'too large allocation' warning or cause the kernel to return -ENOMEM. The fix involves adding the __GFP_NOWARN flag to the allocation request to suppress the warning and relying on standard memory management to handle oversized requests. This prevents the syzbot-reported warning and potential log flooding.

Affected products

  • Linux Linux Kernel up to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3

Timeline

  • 2024-12-16: disclosed: Initial patch submitted by Tetsuo Handa
  • 2025-03-06: advisory: CVE-2024-58085 published

References

Related threats