CVE-2024-53142: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-53142 Overview

CVE-2024-53142 is a buffer overrun vulnerability in the Linux kernel's initramfs subsystem. The vulnerability exists in the do_name() path handler, which processes cpio archive entries during initramfs extraction. When extracting an initramfs cpio archive, the kernel assumes a zero-terminated path at the @collected buffer and passes it directly to functions like filp_open(), init_mkdir(), and init_mknod() without proper validation.

If a specially crafted cpio entry contains a non-zero-terminated filename followed by uninitialized memory, the kernel may create a file with trailing characters representing that uninitialized memory. This out-of-bounds write condition is classified as CWE-787 (Out-of-bounds Write).

Critical Impact
Local attackers with the ability to craft malicious initramfs archives could potentially exploit this buffer overrun to cause memory corruption, leading to denial of service or potentially arbitrary code execution with kernel privileges.

Affected Products

Linux Kernel (multiple versions)

Discovery Timeline

2024-12-06 - CVE-2024-53142 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-53142

Vulnerability Analysis

The initramfs filename field is defined in the kernel documentation (Documentation/driver-api/early-userspace/buffer-format.rst) with a specific cpio format where the c_namesize field indicates the length of the filename including the final null terminator. The vulnerable code path in do_name() assumes that all filename entries are properly null-terminated at the expected position.

When processing a cpio entry, if the filename lacks a null terminator at the expected (name_len - 1) offset, the kernel continues reading beyond the intended buffer boundary. This results in uninitialized heap memory being included in the filename string, which is then passed to file system operations.

The vulnerability is particularly observable when the initramfs is gzip-compressed, as decompression uses heap-allocated buffers (@out_buf in __gunzip()), making uninitialized memory more likely to contain non-zero values compared to the initrd_start+initrd_size memory block used for uncompressed initramfs.

Root Cause

The root cause is insufficient input validation in the initramfs cpio parser. The do_name() function fails to verify that the filename field contains a null terminator at the expected position before passing the filename string to kernel file system functions. The cpio format specification requires that c_namesize includes the null terminator, but the kernel code implicitly trusts this value without validation.

The symlink handler in do_symlink() is not affected because it explicitly zero-terminates the symlink target, preventing overruns past the data segment.

Attack Vector

The attack requires local access to modify or supply a crafted initramfs image. An attacker would need to:

Create a malicious cpio entry with a non-zero-terminated filename
Inject this entry into an initramfs archive
Have the target system boot with the malicious initramfs

The provided reproducer script demonstrates the vulnerability by creating a cpio entry where the filename padding uses 'A' characters instead of null bytes, causing the kernel to create files with names like /initramfs_test_fname_overrunAA* where the trailing characters come from uninitialized memory.

While the upstream advisory notes that the ability to modify initramfs would typically imply existing full control of the system, this vulnerability could still be relevant in scenarios involving initramfs validation, secure boot chains, or containerized environments that process initramfs images.

Detection Methods for CVE-2024-53142

Indicators of Compromise

Presence of unexpected files in the root filesystem with unusual trailing characters in filenames
Files created during boot with names matching the pattern of valid paths followed by garbage characters
Kernel log messages indicating errors during initramfs extraction
Unexplained files with extended ASCII or non-printable characters in filenames

Detection Strategies

Monitor for unusual file creation patterns during system boot by examining early boot logs
Implement initramfs integrity verification using cryptographic signatures before boot
Use kernel auditing facilities to track file operations during initramfs extraction
Deploy endpoint detection that can identify malformed cpio archives in initramfs images

Monitoring Recommendations

Enable kernel auditing for file creation events during early boot stages
Implement file integrity monitoring on critical system directories
Monitor for unexpected changes to initramfs images on disk
Review system boot logs for anomalous filesystem operations

How to Mitigate CVE-2024-53142

Immediate Actions Required

Update the Linux kernel to a patched version that includes the security fix
Verify initramfs image integrity before deployment using checksums or signatures
Restrict access to systems and processes that can modify initramfs images
Audit existing initramfs images for malformed cpio entries

Patch Information

The Linux kernel maintainers have released patches that fix this vulnerability by aborting the initramfs FSM (Finite State Machine) if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset. Multiple patch commits are available across different kernel branches:

Debian has also released security advisories for affected distributions. See the Debian LTS Announcement for additional details.

Workarounds

Implement strict access controls on initramfs images and the tools used to create them
Use secure boot with signed initramfs images to prevent unauthorized modifications
Validate cpio archives before including them in initramfs using archive inspection tools
Consider using alternative initramfs formats that provide built-in integrity checks

bash

# Verify initramfs cpio entry integrity before deployment
# Extract and inspect cpio entries for proper null termination
cpio -tv < /path/to/initramfs.cpio | head -20

# Generate SHA256 checksum of initramfs for integrity monitoring
sha256sum /boot/initramfs-$(uname -r).img > /var/lib/initramfs.sha256