In the Linux kernel, the following vulnerability has been resolved:
initramfs: avoid filename buffer overrun
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpiofile := ALGN(4) + cpioheader + filename + "\0" + ALGN(4) + data ... 55 ============= ================== ========================= 56 Field name Field size Meaning 57 ============= ================== ========================= ... 70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's doname() path handler assumes a zero-terminated path at @collected, passing it directly to filpopen() / initmkdir() / initmknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfstestfname_overrunAA* path. E.g. ./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @outbuf in _gunzip(), rather than the initrdstart+initrdsize block.
---- reproducer.sh ---- nilchar="A" # change to "\0" to properly zero terminate / pad magic="070701" ino=1 mode=$(( 0100777 )) uid=0 gid=0 nlink=1 mtime=1 filesize=0 devmajor=0 devminor=1 rdevmajor=0 rdevminor=0 csum=0 fname="initramfstestfname_overrun" namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
[
{
"id": "CVE-2024-53142-24ceacd0",
"digest": {
"length": 300.0,
"function_hash": "231633889700743485225325449724051214219"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-26370df4",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-2f13dc32",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-3413c72e",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-34f5b753",
"digest": {
"length": 1063.0,
"function_hash": "152122252713769000263882065422017903077"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-3d5c4bcd",
"digest": {
"length": 1034.0,
"function_hash": "338935072406963977442963657598391745024"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-3f13493f",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-405134f5",
"digest": {
"length": 1048.0,
"function_hash": "18545963245022420515884242029478514329"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-45998c62",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-5c325c4d",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-6a22e285",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-6b1ebd36",
"digest": {
"length": 1034.0,
"function_hash": "338935072406963977442963657598391745024"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-6fbacec8",
"digest": {
"length": 1048.0,
"function_hash": "18545963245022420515884242029478514329"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-7b4e28de",
"digest": {
"length": 1063.0,
"function_hash": "152122252713769000263882065422017903077"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-801c568d",
"digest": {
"length": 300.0,
"function_hash": "231633889700743485225325449724051214219"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-81b31b70",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"158869226163930374367314161588065782558"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-929e8166",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-973cf0ce",
"digest": {
"length": 1020.0,
"function_hash": "71406568924107357174653469446628435284"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-a5c86624",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-bd936f69",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-c3d574b4",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-cac57157",
"digest": {
"length": 1020.0,
"function_hash": "71406568924107357174653469446628435284"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-d72e0cbf",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"158869226163930374367314161588065782558"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-dc906922",
"digest": {
"length": 322.0,
"function_hash": "41200004782222954454589297150641906966"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_symlink"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-dfc396c9",
"digest": {
"length": 1048.0,
"function_hash": "18545963245022420515884242029478514329"
},
"deprecated": false,
"target": {
"file": "init/initramfs.c",
"function": "do_name"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-f4ab6592",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-53142-f96d9874",
"digest": {
"line_hashes": [
"256526114454114704869633029610504026003",
"101662607782069792919850183551994559092",
"281893347038184769602759314083220222509",
"56944217198586021884158550965334324529",
"192895976297761224565037962832319737175",
"54041149375828262136918262239289593464",
"108730798180694040696007145948223203562",
"64995189495407033997177591140123942946"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "init/initramfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7",
"signature_type": "Line",
"signature_version": "v1"
}
]