{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58010", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:10:48.227Z", "datePublished": "2025-02-27T02:12:05.165Z", "dateUpdated": "2026-08-05T11:47:25.557Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:25.557Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix integer overflow bug on 32 bit systems\n\nMost of these sizes and counts are capped at 256MB so the math doesn't\nresult in an integer overflow. The \"relocs\" count needs to be checked\nas well. Otherwise on 32bit systems the calculation of \"full_data\"\ncould be wrong.\n\n\tfull_data = data_len + relocs * sizeof(unsigned long);" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only via execve() of a crafted bFLT binary on the local system, with all attacker-controlled inputs coming from the file's flat header. There is no network-facing path into binfmt_flat.\nAC:L - Every value driving the overflow (reloc_count, data_start, data_end, bss_end, stack_size) is read verbatim from the attacker's file header, so the wrap is deterministic and reproducible on the first attempt. No race, no memory-layout guessing, and no victim state is involved.\nPR:L - Any unprivileged local user can create a 64-byte bFLT file, mark it executable, and exec it; no capability, namespace, or filesystem privilege is checked anywhere on the path from sys_execve() to load_flat_file(). Only a basic local account is needed.\nUI:N - The attacker executes the malicious flat binary themselves as part of the attack. No other user has to be induced to open, mount, or run anything.\nS:U - The corruption stays within the operating system's own security authority — kernel memory of the running system. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - On no-MMU targets (binfmt_flat's primary platform) access_ok() is unconditionally true, so the up-to-2^30-iteration relocation loop performs unchecked get_user() reads across the entire flat address space, pulling kernel memory contents into the process image via the relocation write-back. This yields effectively arbitrary kernel memory disclosure to an unprivileged process.\nI:H - The wrapped length turns the final clear_user() into a ~4GB memset() that on no-MMU is an unchecked write of zeros over kernel data, text, and MMIO, while the undersized vm_mmap() plus miscomputed calc_reloc() bounds allow attacker-influenced out-of-bounds relocation writes past the allocation. This is an arbitrary kernel write primitive suitable for privilege escalation.\nA:H - Wholesale zeroing of kernel memory and out-of-bounds writes reliably panic or wedge the system, and the ~1-billion-iteration relocation loop has no cond_resched() or signal check, producing soft-lockup/RCU-stall hangs on its own. Any unprivileged user can trigger this repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/binfmt_flat.c" ], "versions": [ { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "0b6be54d7386b7addbf9e5947366f94aad046938", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "6fb98e0576ea155267e206286413dcb3a3d55c12", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "bc8ca18b8ef4648532c001bd6c8151143b569275", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "95506c7f33452450346fbe2975c1359100f854ca", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "d17ca8f2dfcf423c439859995910a20e38b86f00", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "a009378af674b808efcca1e2e67916e79ce866b3", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "8e8cd712bb06a507b26efd2a56155076aa454345", "status": "affected", "versionType": "git" }, { "version": "c995ee28d29d6f256c3a8a6c4e66469554374f25", "lessThan": "55cf2f4b945f6a6416cc2524ba740b83cc9af25a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/binfmt_flat.c" ], "versions": [ { "version": "4.8", "status": "affected" }, { "version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.78", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.4.291" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0b6be54d7386b7addbf9e5947366f94aad046938" }, { "url": "https://git.kernel.org/stable/c/6fb98e0576ea155267e206286413dcb3a3d55c12" }, { "url": "https://git.kernel.org/stable/c/bc8ca18b8ef4648532c001bd6c8151143b569275" }, { "url": "https://git.kernel.org/stable/c/95506c7f33452450346fbe2975c1359100f854ca" }, { "url": "https://git.kernel.org/stable/c/d17ca8f2dfcf423c439859995910a20e38b86f00" }, { "url": "https://git.kernel.org/stable/c/a009378af674b808efcca1e2e67916e79ce866b3" }, { "url": "https://git.kernel.org/stable/c/8e8cd712bb06a507b26efd2a56155076aa454345" }, { "url": "https://git.kernel.org/stable/c/55cf2f4b945f6a6416cc2524ba740b83cc9af25a" } ], "title": "binfmt_flat: Fix integer overflow bug on 32 bit systems", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:33:25.529Z" } } ] } }