Linux Kernel
CVE-2024-38541
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low privilege required to trigger OF modalias path; kernel memory corruption yields full C/I/A impact with no scope change.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
of: module: add buffer overflow check in of_modalias()
In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str parameter (if not NULL initially) will point beyond the buffer's end. Add the buffer overflow check after the 1st snprintf() call and fix such check after the strlen() call (accounting for the terminating NUL char).
AnalysisAI
Buffer overflow in the Linux kernel's of_modalias() function allows a local low-privileged attacker to potentially corrupt kernel memory, leading to privilege escalation or system crash. The flaw exists in the Open Firmware (OF) module subsystem: when the output buffer is undersized relative to the first snprintf() call, the len variable wraps to a negative value and the str pointer advances past the buffer boundary, enabling out-of-bounds writes in subsequent operations. No public exploit has been identified at time of analysis, though the CVSS score of 7.8 with local C:H/I:H/A:H impact signals serious post-exploitation potential on affected kernels.
Technical ContextAI
The vulnerability resides in of_modalias() within the Linux kernel's drivers/of/module.c, which constructs modalias strings from Open Firmware device tree nodes for automatic kernel module loading. The root cause is CWE-120 (Classic Buffer Copy without Checking Size of Input), specifically a missing bounds check after the first snprintf() invocation: if the formatted string already exceeds the buffer length, len becomes negative (signed integer underflow of the remaining-capacity variable) and the str pointer, if non-NULL, is advanced beyond the allocated buffer end. Any subsequent snprintf() or strlen() call on that corrupted pointer operates on out-of-bounds kernel memory. The fix adds an explicit overflow guard after the first snprintf() and corrects the post-strlen() check to account for the NUL terminator. Affected products span multiple Linux kernel stable branches per seven CPE entries (cpe:2.3:o:linux:linux_kernel:*) and eight distinct stable-tree patch commits, indicating broad version coverage across the 5.x and 6.x series.
RemediationAI
Apply the vendor-released kernel patches available across multiple stable branches via the upstream stable tree; the primary patch references are https://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6 and https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252 among others. Debian LTS users should apply the updates announced at https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html. Exact fixed kernel release versions per stable branch are not confirmed from available data - verify against the upstream stable release tags tied to the listed commits before deploying. As a compensating control where patching is not immediately feasible, restricting local user accounts (minimizing PR:L attack surface) and enforcing mandatory access control policies (SELinux enforcing, AppArmor profiles) reduces the likelihood of exploitation by limiting which processes can trigger the of_modalias() code path. On systems where device tree-based hardware is not used (x86 bare metal without OF support), the code path may be unreachable, though this should be verified per kernel config. There are no known side effects from applying the patch.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today