In the Linux kernel, the following vulnerability has been resolved:
initramfs: avoid filename buffer overrun
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpiofile := ALGN(4) + cpioheader + filename + "\0" + ALGN(4) + data ... 55 ============= ================== ========================= 56 Field name Field size Meaning 57 ============= ================== ========================= ... 70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's doname() path handler assumes a zero-terminated path at @collected, passing it directly to filpopen() / initmkdir() / initmknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfstestfname_overrunAA* path. E.g. ./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @outbuf in _gunzip(), rather than the initrdstart+initrdsize block.
---- reproducer.sh ---- nilchar="A" # change to "\0" to properly zero terminate / pad magic="070701" ino=1 mode=$(( 0100777 )) uid=0 gid=0 nlink=1 mtime=1 filesize=0 devmajor=0 devminor=1 rdevmajor=0 rdevminor=0 csum=0 fname="initramfstestfname_overrun" namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
[ { "signature_type": "Function", "id": "CVE-2024-53142-24ceacd0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "231633889700743485225325449724051214219", "length": 300.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-26370df4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-2f13dc32", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-3413c72e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-34f5b753", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "152122252713769000263882065422017903077", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-3d5c4bcd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "338935072406963977442963657598391745024", "length": 1034.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-3f13493f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-405134f5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "18545963245022420515884242029478514329", "length": 1048.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-45998c62", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-5c325c4d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-6a22e285", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-6b1ebd36", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "338935072406963977442963657598391745024", "length": 1034.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-6fbacec8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "18545963245022420515884242029478514329", "length": 1048.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-7b4e28de", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "152122252713769000263882065422017903077", "length": 1063.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-801c568d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "231633889700743485225325449724051214219", "length": 300.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-81b31b70", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb7ac96670ab1d8d681015f9d66e45dad579af4d", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "158869226163930374367314161588065782558" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-929e8166", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a423bbbeaf9e3e20c4686501efd9b661fe834db", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-973cf0ce", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3df9f26cff97beaa5643e551031795d5d5cddbe", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "71406568924107357174653469446628435284", "length": 1020.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-a5c86624", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-bd936f69", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-c3d574b4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-cac57157", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6983b8ac787b3add5571cda563574932a59a99bb", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "71406568924107357174653469446628435284", "length": 1020.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-d72e0cbf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c509b1acbd867d9e09580fe059a924cb5825afb1", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "158869226163930374367314161588065782558" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-dc906922", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f892ddcf9f645380c358e73653cb0900f6bc9eb8", "signature_version": "v1", "target": { "function": "do_symlink", "file": "init/initramfs.c" }, "digest": { "function_hash": "41200004782222954454589297150641906966", "length": 322.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53142-dfc396c9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb83b093f75806333b6f4ae29b158d2e0e3ec971", "signature_version": "v1", "target": { "function": "do_name", "file": "init/initramfs.c" }, "digest": { "function_hash": "18545963245022420515884242029478514329", "length": 1048.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-f4ab6592", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e017671f534dd3f568db9e47b0583e853d2da9b5", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53142-f96d9874", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d01e736c3045319e030d1e75fb983011abaca7", "signature_version": "v1", "target": { "file": "init/initramfs.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "256526114454114704869633029610504026003", "101662607782069792919850183551994559092", "281893347038184769602759314083220222509", "56944217198586021884158550965334324529", "192895976297761224565037962832319737175", "54041149375828262136918262239289593464", "108730798180694040696007145948223203562", "64995189495407033997177591140123942946" ] }, "deprecated": false } ]