CVE-2024-27413 efi/capsule-loader: fix incorrect allocation size

2024-05-1711:50:53

Linux

github.com

linux kernel

vulnerability

efi/capsule-loader

allocation size

phys_addr_t

32-bit

64-bit

gcc-14

error

allocation

phys_addr_t

type

cve

AI Score

6.8

Confidence

Low

EPSS

Percentile

13.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

efi/capsule-loader: fix incorrect allocation size

gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures
is not enough for a 64-bit phys_addr_t:

drivers/firmware/efi/capsule-loader.c: In function ‘efi_capsule_open’:
drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size ‘4’ for type ‘phys_addr_t’ {aka ‘long long unsigned int’} with size ‘8’ [-Werror=alloc-size]
295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL);
| ^

Use the correct type instead here.

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "00cf21ac5260",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "950d4d74d311",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "537e3f49dbe8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "4b73473c050a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "ddc547dd05a4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "11aabd748785",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "62a5dcd9bd30",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f24c4d478013",
        "lessThan": "fccfa646ef36",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/firmware/efi/capsule-loader.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.15",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "4.19.309",
        "versionType": "custom",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.271",
        "versionType": "custom",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.212",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.151",
        "versionType": "custom",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.81",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.21",
        "versionType": "custom",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.7.9",
        "versionType": "custom",
        "lessThanOrEqual": "6.7.*"
      },
      {
        "status": "unaffected",
        "version": "6.8",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/firmware/efi/capsule-loader.c"
    ],
    "defaultStatus": "affected"
  }
]