NetSight
IP …
high7.8

CVE-2024-26988

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size '…

Impact

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.1 before 5.10.216
from 5.11 before 5.15.157
from 5.16 before 6.1.88
from 6.2 before 6.6.29
from 6.7 before 6.8.8
Version 6.9
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 38, 39, 40

Weakness classification

CWE-787

References