We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-26988

init/main.c: Fix potential static_command_line memory overflow



AssignerLinux
Reserved2024-02-19
Published2024-05-01
Updated2024-09-11

Description

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")

Product status

Default status
unaffected

f5c7310ac73e before 2ef607ea1036
affected

f5c7310ac73e before 0dc727a4e054
affected

f5c7310ac73e before 76c2f4d426a5
affected

f5c7310ac73e before 81cf85ae4f2d
affected

f5c7310ac73e before 936a02b5a963
affected

f5c7310ac73e before 46dad3c1e578
affected

Default status
affected

5.1
affected

Any version before 5.1
unaffected

5.10.216
unaffected

5.15.157
unaffected

6.1.88
unaffected

6.6.29
unaffected

6.8.8
unaffected

6.9
unaffected

References

https://git.kernel.org/stable/c/2ef607ea103616aec0289f1b65d103d499fa903a

https://git.kernel.org/stable/c/0dc727a4e05400205358a22c3d01ccad2c8e1fe4

https://git.kernel.org/stable/c/76c2f4d426a5358fced5d5990744d46f10a4ccea

https://git.kernel.org/stable/c/81cf85ae4f2dd5fa3e43021782aa72c4c85558e8

https://git.kernel.org/stable/c/936a02b5a9630c5beb0353c3085cc49d86c57034

https://git.kernel.org/stable/c/46dad3c1e57897ab9228332f03e1c14798d2d3b9

https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

cve.org CVE-2024-26988

nvd.nist.gov CVE-2024-26988

Download JSON

Share this page
https://cve.threatint.com
Subscribe to our newsletter to learn more about our work.