In the Linux kernel, the following vulnerability has been resolved:
init/main.c: Fix potential static_command_line memory overflow
We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line.
When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow.
This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 5.1 | 5.10.216 |
| linux / linux_kernel | 5.11 | 5.15.157 |
| linux / linux_kernel | 5.16 | 6.1.88 |
| linux / linux_kernel | 6.2 | 6.6.29 |
| linux / linux_kernel | 6.7 | 6.8.8 |
| linux / linux_kernel | 6.9-rc1 | 6.9-rc1.x |
| linux / linux_kernel | 6.9-rc2 | 6.9-rc2.x |
| linux / linux_kernel | 6.9-rc3 | 6.9-rc3.x |
| linux / linux_kernel | 6.9-rc4 | 6.9-rc4.x |
| debian / debian_linux | 10.0 | 10.0.x |
| fedoraproject / fedora | 38 | 38.x |
| fedoraproject / fedora | 39 | 39.x |
| fedoraproject / fedora | 40 | 40.x |