In the Linux kernel, the following vulnerability has been...
Unreviewed
Published
May 1, 2024
to the GitHub Advisory Database
•
Updated Jun 26, 2024
Description
Published by the National Vulnerability Database
May 1, 2024
Published to the GitHub Advisory Database
May 1, 2024
Last updated
Jun 26, 2024
In the Linux kernel, the following vulnerability has been resolved:
init/main.c: Fix potential static_command_line memory overflow
We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for
static_command_line, but the strings copied into static_command_line are
extra_command_line and command_line, rather than extra_command_line and
boot_command_line.
When strlen(command_line) > strlen(boot_command_line), static_command_line
will overflow.
This patch just recovers strlen(command_line) which was miss-consolidated
with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add
checks for the return value of memblock_alloc*()")
References