CVE-2024-53142: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-53142 Overview

CVE-2024-53142 is a buffer overrun vulnerability in the Linux kernel's initramfs subsystem. The vulnerability exists in the do_name() path handler, which processes cpio archive entries during initramfs extraction. When extracting an initramfs cpio archive, the kernel assumes a zero-terminated path at the @collected buffer and passes it directly to functions like filp_open(), init_mkdir(), and init_mknod() without proper validation.

If a specially crafted cpio entry contains a non-zero-terminated filename followed by uninitialized memory, the kernel may create a file with trailing characters representing that uninitialized memory. This out-of-bounds write condition is classified as CWE-787 (Out-of-bounds Write).

Critical Impact

Local attackers with the ability to craft malicious initramfs archives could potentially exploit this buffer overrun to cause memory corruption, leading to denial of service or potentially arbitrary code execution with kernel privileges.

Affected Products

• Linux Kernel (multiple versions)

Discovery Timeline

• 2024-12-06 - CVE-2024-53142 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-53142

Vulnerability Analysis

The initramfs filename field is defined in the kernel documentation (Documentation/driver-api/early-userspace/buffer-format.rst) with a specific cpio format where the c_namesize field indicates the length of the filename including the final null terminator. The vulnerable code path in do_name() assumes that all filename entries are properly null-terminated at the expected position.

When processing a cpio entry, if the filename lacks a null terminator at the expected (name_len - 1) offset, the kernel continues reading beyond the intended buffer boundary. This results in uninitialized heap memory being included in the filename string, which is then passed to file system operations.

The vulnerability is particularly observable when the initramfs is gzip-compressed, as decompression uses heap-allocated buffers (@out_buf in __gunzip()), making uninitialized memory more likely to contain non-zero values compared to the initrd_start+initrd_size memory block used for uncompressed initramfs.

Root Cause

The root cause is insufficient input validation in the initramfs cpio parser. The do_name() function fails to verify that the filename field contains a null terminator at the expected position before passing the filename string to kernel file system functions. The cpio format specification requires that c_namesize includes the null terminator, but the kernel code implicitly trusts this value without validation.

The symlink handler in do_symlink() is not affected because it explicitly zero-terminates the symlink target, preventing overruns past the data segment.

Attack Vector

The attack requires local access to modify or supply a crafted initramfs image. An attacker would need to:

1. Create a malicious cpio entry with a non-zero-terminated filename
2. Inject this entry into an initramfs archive
3. Have the target system boot with the malicious initramfs

The provided reproducer script demonstrates the vulnerability by creating a cpio entry where the filename padding uses 'A' characters instead of null bytes, causing the kernel to create files with names like /initramfs_test_fname_overrunAA* where the trailing characters come from uninitialized memory.

While the upstream advisory notes that the ability to modify initramfs would typically imply existing full control of the system, this vulnerability could still be relevant in scenarios involving initramfs validation, secure boot chains, or containerized environments that process initramfs images.

Detection Methods for CVE-2024-53142

Indicators of Compromise

• Presence of unexpected files in the root filesystem with unusual trailing characters in filenames
• Files created during boot with names matching the pattern of valid paths followed by garbage characters
• Kernel log messages indicating errors during initramfs extraction
• Unexplained files with extended ASCII or non-printable characters in filenames

Detection Strategies

• Monitor for unusual file creation patterns during system boot by examining early boot logs
• Implement initramfs integrity verification using cryptographic signatures before boot
• Use kernel auditing facilities to track file operations during initramfs extraction
• Deploy endpoint detection that can identify malformed cpio archives in initramfs images

Monitoring Recommendations

• Enable kernel auditing for file creation events during early boot stages
• Implement file integrity monitoring on critical system directories
• Monitor for unexpected changes to initramfs images on disk
• Review system boot logs for anomalous filesystem operations

How to Mitigate CVE-2024-53142

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the security fix
• Verify initramfs image integrity before deployment using checksums or signatures
• Restrict access to systems and processes that can modify initramfs images
• Audit existing initramfs images for malformed cpio entries

Patch Information

The Linux kernel maintainers have released patches that fix this vulnerability by aborting the initramfs FSM (Finite State Machine) if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset. Multiple patch commits are available across different kernel branches:

• Commit 1a423bbbeaf9e3e20c4686501efd9b661fe834db
• Commit 49d01e736c3045319e030d1e75fb983011abaca7
• Commit bb7ac96670ab1d8d681015f9d66e45dad579af4d
• Commit e017671f534dd3f568db9e47b0583e853d2da9b5
• Commit fb83b093f75806333b6f4ae29b158d2e0e3ec971

Debian has also released security advisories for affected distributions. See the Debian LTS Announcement for additional details.

Workarounds

• Implement strict access controls on initramfs images and the tools used to create them
• Use secure boot with signed initramfs images to prevent unauthorized modifications
• Validate cpio archives before including them in initramfs using archive inspection tools
• Consider using alternative initramfs formats that provide built-in integrity checks

# Verify initramfs cpio entry integrity before deployment
# Extract and inspect cpio entries for proper null termination
cpio -tv < /path/to/initramfs.cpio | head -20

# Generate SHA256 checksum of initramfs for integrity monitoring
sha256sum /boot/initramfs-$(uname -r).img > /var/lib/initramfs.sha256