vmalloc Buffer Overflow in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's vmalloc subsystem, specifically in the function vrealloc_node_align(). A recent change allowed forcing a new memory allocation if the current pointer is on the wrong NUMA node or does not meet alignment constraints, even when shrinking the allocation.

During this process, the code allocates a new buffer of the requested size and copies the old data into it using memcpy(). However, if the new requested size is smaller than the old size (shrinking), the memcpy() copies more data than the new buffer can hold, causing a buffer overflow (out-of-bounds write).

The fix bounds the copy length by the new allocation size to prevent this overflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a buffer overflow in kernel memory when shrinking vmalloc allocations under certain conditions. Such an out-of-bounds write can cause memory corruption, potentially leading to system instability, crashes, or exploitation by attackers to execute arbitrary code with kernel privileges.

Useful 0 Not Useful 0