CVE-2024-58010 (GCVE-0-2024-58010)
Vulnerability from cvelistv5
Published
2025-02-27 02:12
Modified
2026-08-05 11:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix integer overflow bug on 32 bit systems Most of these sizes and counts are capped at 256MB so the math doesn't result in an integer overflow. The "relocs" count needs to be checked as well. Otherwise on 32bit systems the calculation of "full_data" could be wrong. full_data = data_len + relocs * sizeof(unsigned long);
References
Impacted products
Vendor Product Version
Linux Linux Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
Version: c995ee28d29d6f256c3a8a6c4e66469554374f25
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:33:25.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_flat.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b6be54d7386b7addbf9e5947366f94aad046938",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "6fb98e0576ea155267e206286413dcb3a3d55c12",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "bc8ca18b8ef4648532c001bd6c8151143b569275",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "95506c7f33452450346fbe2975c1359100f854ca",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "d17ca8f2dfcf423c439859995910a20e38b86f00",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "a009378af674b808efcca1e2e67916e79ce866b3",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "8e8cd712bb06a507b26efd2a56155076aa454345",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            },
            {
              "lessThan": "55cf2f4b945f6a6416cc2524ba740b83cc9af25a",
              "status": "affected",
              "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_flat.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix integer overflow bug on 32 bit systems\n\nMost of these sizes and counts are capped at 256MB so the math doesn\u0027t\nresult in an integer overflow.  The \"relocs\" count needs to be checked\nas well.  Otherwise on 32bit systems the calculation of \"full_data\"\ncould be wrong.\n\n\tfull_data = data_len + relocs * sizeof(unsigned long);"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only via execve() of a crafted bFLT binary on the local system, with all attacker-controlled inputs coming from the file\u0027s flat header. There is no network-facing path into binfmt_flat.\nAC:L - Every value driving the overflow (reloc_count, data_start, data_end, bss_end, stack_size) is read verbatim from the attacker\u0027s file header, so the wrap is deterministic and reproducible on the first attempt. No race, no memory-layout guessing, and no victim state is involved.\nPR:L - Any unprivileged local user can create a 64-byte bFLT file, mark it executable, and exec it; no capability, namespace, or filesystem privilege is checked anywhere on the path from sys_execve() to load_flat_file(). Only a basic local account is needed.\nUI:N - The attacker executes the malicious flat binary themselves as part of the attack. No other user has to be induced to open, mount, or run anything.\nS:U - The corruption stays within the operating system\u0027s own security authority \u2014 kernel memory of the running system. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - On no-MMU targets (binfmt_flat\u0027s primary platform) access_ok() is unconditionally true, so the up-to-2^30-iteration relocation loop performs unchecked get_user() reads across the entire flat address space, pulling kernel memory contents into the process image via the relocation write-back. This yields effectively arbitrary kernel memory disclosure to an unprivileged process.\nI:H - The wrapped length turns the final clear_user() into a ~4GB memset() that on no-MMU is an unchecked write of zeros over kernel data, text, and MMIO, while the undersized vm_mmap() plus miscomputed calc_reloc() bounds allow attacker-influenced out-of-bounds relocation writes past the allocation. This is an arbitrary kernel write primitive suitable for privilege escalation.\nA:H - Wholesale zeroing of kernel memory and out-of-bounds writes reliably panic or wedge the system, and the ~1-billion-iteration relocation loop has no cond_resched() or signal check, producing soft-lockup/RCU-stall hangs on its own. Any unprivileged user can trigger this repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:25.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b6be54d7386b7addbf9e5947366f94aad046938"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb98e0576ea155267e206286413dcb3a3d55c12"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc8ca18b8ef4648532c001bd6c8151143b569275"
        },
        {
          "url": "https://git.kernel.org/stable/c/95506c7f33452450346fbe2975c1359100f854ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/d17ca8f2dfcf423c439859995910a20e38b86f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/a009378af674b808efcca1e2e67916e79ce866b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e8cd712bb06a507b26efd2a56155076aa454345"
        },
        {
          "url": "https://git.kernel.org/stable/c/55cf2f4b945f6a6416cc2524ba740b83cc9af25a"
        }
      ],
      "title": "binfmt_flat: Fix integer overflow bug on 32 bit systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58010",
    "datePublished": "2025-02-27T02:12:05.165Z",
    "dateReserved": "2025-02-27T02:10:48.227Z",
    "dateUpdated": "2026-08-05T11:47:25.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.