CVE-2024-58085

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58085
In the Linux kernel, the following vulnerability has been resolved: tomoyo: don't emit warning in tomoyo_write_control() syzbot is reporting too large allocation warning at tomoyo_write_control(), for one can write a very very long line without new line character. To fix this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE, for practically a valid line should be always shorter than 32KB where the "too small to fail" memory-allocation rule applies. One might try to write a valid line that is longer than 32KB, but such request will likely fail with -ENOMEM. Therefore, I feel that separately returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant. There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3df7546fc03b8f004eee0b9e3256369f7d096685 Patch
https://git.kernel.org/stable/c/414705c0303350d139b1dc18f329fe47dfb642dd Patch
https://git.kernel.org/stable/c/a01c200fa7eb59da4d2dbbb48b61f4a0d196c09f Patch
https://git.kernel.org/stable/c/b2bd5857a0d6973ebbcb4d9831ddcaebbd257be1 Patch
https://git.kernel.org/stable/c/c67efabddc73171c7771d3ffe4ffa1e503ee533e Patch
https://git.kernel.org/stable/c/c9382f380e8d09209b8e5c0def0545852168be25 Patch
https://git.kernel.org/stable/c/f6b37b3e12de638753bce79a2858070b9c4a4ad3 Patch
https://git.kernel.org/stable/c/fe1c021eb03dae0dc9dce55e81f77a60e419a27a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Oct 2025, 16:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/3df7546fc03b8f004eee0b9e3256369f7d096685 - () https://git.kernel.org/stable/c/3df7546fc03b8f004eee0b9e3256369f7d096685 - Patch
References () https://git.kernel.org/stable/c/414705c0303350d139b1dc18f329fe47dfb642dd - () https://git.kernel.org/stable/c/414705c0303350d139b1dc18f329fe47dfb642dd - Patch
References () https://git.kernel.org/stable/c/a01c200fa7eb59da4d2dbbb48b61f4a0d196c09f - () https://git.kernel.org/stable/c/a01c200fa7eb59da4d2dbbb48b61f4a0d196c09f - Patch
References () https://git.kernel.org/stable/c/b2bd5857a0d6973ebbcb4d9831ddcaebbd257be1 - () https://git.kernel.org/stable/c/b2bd5857a0d6973ebbcb4d9831ddcaebbd257be1 - Patch
References () https://git.kernel.org/stable/c/c67efabddc73171c7771d3ffe4ffa1e503ee533e - () https://git.kernel.org/stable/c/c67efabddc73171c7771d3ffe4ffa1e503ee533e - Patch
References () https://git.kernel.org/stable/c/c9382f380e8d09209b8e5c0def0545852168be25 - () https://git.kernel.org/stable/c/c9382f380e8d09209b8e5c0def0545852168be25 - Patch
References () https://git.kernel.org/stable/c/f6b37b3e12de638753bce79a2858070b9c4a4ad3 - () https://git.kernel.org/stable/c/f6b37b3e12de638753bce79a2858070b9c4a4ad3 - Patch
References () https://git.kernel.org/stable/c/fe1c021eb03dae0dc9dce55e81f77a60e419a27a - () https://git.kernel.org/stable/c/fe1c021eb03dae0dc9dce55e81f77a60e419a27a - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

13 Mar 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tomoyo: no emitir advertencia en tomoyo_write_control() syzbot informa una advertencia de asignación demasiado grande en tomoyo_write_control(), ya que se puede escribir una línea muy larga sin un carácter de nueva línea. Para corregir esta advertencia, uso __GFP_NOWARN en lugar de verificar KMALLOC_MAX_SIZE, ya que prácticamente una línea válida siempre debe ser más corta que 32 KB donde se aplica la regla de asignación de memoria "demasiado pequeña para fallar". Uno podría intentar escribir una línea válida que sea más larga que 32 KB, pero tal solicitud probablemente fallará con -ENOMEM. Por lo tanto, creo que devolver por separado -EINVAL cuando una línea es más larga que KMALLOC_MAX_SIZE es redundante. No hay necesidad de distinguir entre más de 32 KB y más de KMALLOC_MAX_SIZE.
References
  • () https://git.kernel.org/stable/c/b2bd5857a0d6973ebbcb4d9831ddcaebbd257be1 -
  • () https://git.kernel.org/stable/c/c67efabddc73171c7771d3ffe4ffa1e503ee533e -
  • () https://git.kernel.org/stable/c/f6b37b3e12de638753bce79a2858070b9c4a4ad3 -

06 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-06 17:15

Updated : 2025-10-31 16:25

NVD link : CVE-2024-58085

Mitre link : CVE-2024-58085

CVE.ORG link : CVE-2024-58085

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo