Out-of-Bounds Affecting kernel-debug-devel package, versions <0:4.18.0-553.16.1.el8_10
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-KERNELDEBUGDEVEL-7513134
- published 17 Jul 2024
- disclosed 12 Jul 2024
Introduced: 12 Jul 2024
CVE-2024-40974 Open this link in a new tabHow to fix?
Upgrade RHEL:8 kernel-debug-devel to version 0:4.18.0-553.16.1.el8_10 or higher.
This issue was patched in RHSA-2024:5101.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debug-devel package and not the kernel-debug-devel package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: Enforce hcall result buffer validity and size
plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea.
For example, if I write a bug like this:
long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
This compiles with no diagnostics emitted, but likely results in stack corruption at runtime when plpar_hcall9() stores results past the end of the array. (To be clear this is a contrived example and I have not found a real instance yet.)
To make this class of error less likely, we can use explicitly-sized array parameters instead of pointers in the declarations for the hcall APIs. When compiled with -Warray-bounds[1], the code above now provokes a diagnostic like this:
error: array argument is too small; is of size 32, callee requires at least 72 [-Werror,-Warray-bounds] 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, | ^ ~~~~~~
[1] Enabled for LLVM builds but not GCC for now. See commit 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and related changes.
References
- https://access.redhat.com/security/cve/CVE-2024-40974
- https://git.kernel.org/stable/c/19c166ee42cf16d8b156a6cb4544122d9a65d3ca
- https://git.kernel.org/stable/c/262e942ff5a839b9e4f3302a8987928b0c8b8a2d
- https://git.kernel.org/stable/c/3ad0034910a57aa88ed9976b1431b7b8c84e0048
- https://git.kernel.org/stable/c/8aa11aa001576bf3b00dcb8559564ad7a3113588
- https://git.kernel.org/stable/c/a8c988d752b3d98d5cc1e3929c519a55ef55426c
- https://git.kernel.org/stable/c/aa6107dcc4ce9a3451f2d729204713783b657257
- https://git.kernel.org/stable/c/acf2b80c31c37acab040baa3cf5f19fbd5140b18
- https://git.kernel.org/stable/c/ff2e185cf73df480ec69675936c4ee75a445c3e4