Linux: Out-of-bounds Write
CVE-2024-35976 is a high-severity out-of-bounds write vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions beb99266830520e15fbc6ca8cc5a5240d76851fd, 0b45c25d60e38f5c2cb6823f886773a34323306d, a82984b3c6a7e8c7937dba6e857ddf829d149417 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to beb99266830520e15fbc6ca8cc5a5240d76851fd or 0b45c25d60e38f5c2cb6823f886773a34323306d or a82984b3c6a7e8c7937dba6e857ddf829d149417 or f0a068de65d5b7358e9aff792716afa9333f3922, whichever matches your release line, or a later version.
- Update RUGGEDCOM RST2428P to V3.1 or a later version.
- Update SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.1 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, beb99266830520e15fbc6ca8cc5a5240d76851fd; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, 0b45c25d60e38f5c2cb6823f886773a34323306d; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, a82984b3c6a7e8c7937dba6e857ddf829d149417; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, f0a068de65d5b7358e9aff792716afa9333f3922; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, 2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, b143e19dc28c3211f050f7848d87d9b0a170e10c; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, 2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6; 423f38329d267969130fb6f2c685f73d72687558 up to, but not including, 237f3cf13b20db183d3706d997eedc3c49eacd44; and 1 more ranges | beb99266830520e15fbc6ca8cc5a5240d76851fd, 0b45c25d60e38f5c2cb6823f886773a34323306d, a82984b3c6a7e8c7937dba6e857ddf829d149417, f0a068de65d5b7358e9aff792716afa9333f3922, 2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa, b143e19dc28c3211f050f7848d87d9b0a170e10c |
| Linux | linux_kernel | 4.18 | Not stated |
| Siemens | RUGGEDCOM RST2428P | before V3.1 | V3.1 |
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family | Not specified in the record | Not stated |
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family | before V3.1 | V3.1 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.1 | High | CNA |
| CVSS 3.1 | 6.7 | Medium | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2) The buggy address belongs to the physical page: page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001 raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c: ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d
- git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44
- git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa
- git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6
- git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417
- git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c
- git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd
- git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922
Other references
Recent Out-of-bounds Write vulnerabilities
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.