CVE - CVE-2024-26988

CVE-ID
CVE-2024-26988	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0dc727a4e05400205358a22c3d01ccad2c8e1fe4 URL:https://git.kernel.org/stable/c/0dc727a4e05400205358a22c3d01ccad2c8e1fe4 MISC:https://git.kernel.org/stable/c/2ef607ea103616aec0289f1b65d103d499fa903a URL:https://git.kernel.org/stable/c/2ef607ea103616aec0289f1b65d103d499fa903a MISC:https://git.kernel.org/stable/c/46dad3c1e57897ab9228332f03e1c14798d2d3b9 URL:https://git.kernel.org/stable/c/46dad3c1e57897ab9228332f03e1c14798d2d3b9 MISC:https://git.kernel.org/stable/c/76c2f4d426a5358fced5d5990744d46f10a4ccea URL:https://git.kernel.org/stable/c/76c2f4d426a5358fced5d5990744d46f10a4ccea MISC:https://git.kernel.org/stable/c/81cf85ae4f2dd5fa3e43021782aa72c4c85558e8 URL:https://git.kernel.org/stable/c/81cf85ae4f2dd5fa3e43021782aa72c4c85558e8 MISC:https://git.kernel.org/stable/c/936a02b5a9630c5beb0353c3085cc49d86c57034 URL:https://git.kernel.org/stable/c/936a02b5a9630c5beb0353c3085cc49d86c57034
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)