Incorrect sizeof in phys array reallocation in Linux kernel

Executive Summary

This vulnerability exists in the Linux kernel's EFI capsule loader code. Specifically, it involves an incorrect use of the sizeof operator during memory reallocation for an array of physical addresses (phys array). The code uses sizeof(phys_addr_t *) (size of a pointer) instead of sizeof(phys_addr_t) (size of the actual physical address type) when reallocating memory.

On 64-bit systems, where the size of a pointer and the size of phys_addr_t are the same, this mistake does not cause issues. However, on 32-bit systems with Physical Address Extension (PAE), phys_addr_t is 64-bit while pointers are 32-bit. This leads to allocating only half the required memory, potentially causing a heap buffer overflow when storing physical addresses.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a heap buffer overflow on affected systems (32-bit with PAE). This means that when the system stores physical addresses, it might write beyond the allocated memory buffer, potentially corrupting adjacent memory.

Heap buffer overflows can cause system instability, crashes, or potentially be exploited by attackers to execute arbitrary code or escalate privileges, depending on the context and other system protections.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability relates to an incorrect memory allocation size in the Linux kernel's EFI capsule loader code, specifically in the __efi_capsule_setup_info() function. Detection would typically involve verifying the kernel version or patch level to see if this fix has been applied.

Since this is a kernel-level issue, direct detection via network commands is not applicable. Instead, you can check your running kernel version and compare it against versions known to include this fix.

Suggested commands to gather relevant information include:

• uname -a # To display the current kernel version and architecture
• dmesg | grep -i efi # To check EFI-related kernel messages
• grep CONFIG_EFI /boot/config-$(uname -r) # To verify EFI support in the kernel configuration

For a more precise detection, you would need to verify if the kernel source includes the patch fixing the incorrect sizeof usage in the capsule loader code, which may require source code or patch level inspection.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update your Linux kernel to a version that includes the fix for this vulnerability.

Since the issue is caused by incorrect memory allocation in the EFI capsule loader on 32-bit systems with PAE, applying the patch that corrects the sizeof usage in __efi_capsule_setup_info() will prevent potential heap buffer overflows.

If an immediate kernel update is not possible, consider disabling EFI capsule loading features if they are not required in your environment, though this may impact system functionality.

Regularly monitor for kernel updates and security advisories from your Linux distribution to ensure timely application of patches.

Useful 0 Not Useful 0