CVE-2024-53142 in Linux
Summary
by MITRE • 12/06/2024
In the Linux kernel, the following vulnerability has been resolved:
initramfs: avoid filename buffer overrun
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55 ============= ================== ========================= 56 Field name Field size Meaning 57 ============= ================== ========================= ... 70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g. ./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block.
---- reproducer.sh ---- nilchar="A" # change to "\0" to properly zero terminate / pad magic="070701" ino=1 mode=$(( 0100777 )) uid=0 gid=0 nlink=1 mtime=1 filesize=0 devmajor=0 devminor=1 rdevmajor=0 rdevminor=0 csum=0 fname="initramfs_test_fname_overrun" namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen)
---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2025
The vulnerability described in CVE-2024-53142 resides within the Linux kernel's handling of initramfs cpio archives during the early boot process. This issue manifests as a potential buffer overrun in the filename field processing logic, specifically when the kernel extracts files from an initramfs archive. The cpio format specification defines the structure of cpio entries including a filename field that must be null-terminated according to the documentation. However, when a maliciously crafted cpio entry contains a filename that is not properly null-terminated, the kernel's extraction logic can inadvertently include uninitialized memory segments in the resulting filename, leading to potential data leakage or unintended file creation behavior.
The technical flaw occurs in the kernel's do_name() function which processes cpio entries without proper validation of the filename termination. When a cpio entry with a non-zero-terminated filename is encountered, the kernel's path handler passes this unvalidated string directly to file system operations such as filp_open(), init_mkdir(), and init_mknod(). This behavior is particularly concerning because it can lead to the creation of files with unexpected names containing data from uninitialized memory regions. The vulnerability is specifically triggered when a cpio entry's filename field extends beyond its intended bounds and includes subsequent memory content, which can be observed in the reproducer script's output. The issue affects the initramfs extraction process where the kernel state machine processes cpio entries sequentially, and any malformed entry can cause the state machine to proceed with invalid data.
The operational impact of this vulnerability is significant for kernel security and system integrity. While the vulnerability itself does not introduce a direct security exploit vector since creating initramfs entries typically requires pre-existing system control, it does represent a potential data exposure risk. The inclusion of uninitialized memory in filenames could reveal sensitive information from kernel memory space, potentially exposing system state or other confidential data. Additionally, the behavior could lead to unpredictable file system state during early boot, which might affect system stability or create unexpected conditions that could be leveraged in combination with other vulnerabilities. The issue is particularly relevant in environments where initramfs archives are processed from untrusted sources, as it could enable information leakage through the filename fields of extracted files.
The fix implemented addresses this vulnerability by introducing a validation check within the initramfs finite state machine. Specifically, the kernel now aborts processing of cpio entries if any filename field does not contain a proper null-terminator at the expected offset position. This approach directly addresses the root cause by ensuring that all filenames processed during initramfs extraction are properly terminated before being passed to file system operations. The solution aligns with security best practices by implementing defensive programming techniques that validate input data before processing, preventing the propagation of malformed data through the system. This fix is consistent with the principles outlined in CWE-121, which addresses buffer overflow vulnerabilities, and follows the ATT&CK technique T1059.003 for execution through file system manipulation. The implementation ensures that the kernel's initramfs processing remains robust against malformed cpio entries while maintaining compatibility with standard cpio archive formats.
This vulnerability demonstrates the importance of proper input validation in kernel space operations, particularly during critical early boot phases where system integrity is paramount. The fix represents a defensive measure that prevents potential information leakage and system instability caused by malformed data processing. The security implications extend beyond immediate data exposure to include potential system reliability concerns, as malformed initramfs processing could lead to unpredictable system behavior during boot sequences. The solution emphasizes the need for robust validation mechanisms in kernel subsystems that handle untrusted input data, particularly in early boot environments where the system state is most vulnerable to corruption. This vulnerability highlights the ongoing challenge of maintaining security in kernel space code where input validation must be thorough and comprehensive to prevent unexpected behaviors that could compromise system integrity.