REDHAT-BUG-2396936: Medium severity linux_kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
audit: fix out-of-bounds read in auditcomparednamepath()
When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-of-bounds read can occur in auditcomparednamepath().
The helper parentlen() returns 1 for "/". In auditcomparednamepath(), when parentlen equals the full path length (1), the code sets p = path + 1 and pathlen = 1 - 1 = 0. The subsequent loop then dereferences p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.
Fix this by adding a pathlen > 0 check to the while loop condition to prevent the out-of-bounds access.
[PM: subject tweak, sign-off email fixes]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In audit_compare_dname_path(), update the while loop condition to include a 'pathlen > 0' check to prevent dereferencing p[pathlen - 1] (e.g., p[-1]) when pathlen evaluates to 0 for paths like creating /a under dir=/ combined with an fsnotify event.
Linux kernel audit: audit_compare_dname_path() while loop condition in audit_compare_dname_path() = add check for pathlen > 0 before accessing p[pathlen - 1]
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2396936?
The severity of REDHAT-BUG-2396936 is high due to the potential for an out-of-bounds read in the Linux kernel.
How do I fix REDHAT-BUG-2396936?
To fix REDHAT-BUG-2396936, apply the latest kernel security updates provided by your Linux distribution.
What is the impact of REDHAT-BUG-2396936?
The impact of REDHAT-BUG-2396936 could lead to information exposure through an out-of-bounds read.
Which versions of the Linux kernel are affected by REDHAT-BUG-2396936?
REDHAT-BUG-2396936 affects specific versions of the Linux kernel that support fsnotify events.
Is REDHAT-BUG-2396936 remotely exploitable?
REDHAT-BUG-2396936 is not remotely exploitable and requires local access to trigger the out-of-bounds read.