In the Linux kernel, the following vulnerability has been resolved:
kdb: Fix buffer overflow during tab-complete
Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer.
Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around.
[
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4198.0,
"function_hash": "13869530684771232947420133431342059840"
},
"id": "CVE-2024-39480-1caacbde",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d9c814652b971461d1e30bead6792851c209e7",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-44d3cba5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f636a40834d22e5e3fc748f060211879c056cd33",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4208.0,
"function_hash": "30976790032925482321940147679410440935"
},
"id": "CVE-2024-39480-54793acf",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9730744bf3af04cda23799029342aa3cddbc454",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4208.0,
"function_hash": "30976790032925482321940147679410440935"
},
"id": "CVE-2024-39480-5b754693",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@107e825cc448b7834b31e8b1b3cf0f57426d46d5",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-77086f6e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb824a99e148ff272a53d71d84122728b5f00992",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-834ab3ed",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d9c814652b971461d1e30bead6792851c209e7",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4245.0,
"function_hash": "140648798559117336689012730137678828629"
},
"id": "CVE-2024-39480-87fd8199",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb824a99e148ff272a53d71d84122728b5f00992",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4198.0,
"function_hash": "13869530684771232947420133431342059840"
},
"id": "CVE-2024-39480-8b3d39e2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfdc2fa4db57503bc6d3817240547c8ddc55fa96",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-90c248fe",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f694da720dcf795dc3eb97bf76d220213f76aaa7",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4208.0,
"function_hash": "30976790032925482321940147679410440935"
},
"id": "CVE-2024-39480-90dc40f8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f694da720dcf795dc3eb97bf76d220213f76aaa7",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-97218a0e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9730744bf3af04cda23799029342aa3cddbc454",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-9f147f25",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd2972d8e2dee3b33e8121669d55def59f0be8a",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-d55cd895",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@107e825cc448b7834b31e8b1b3cf0f57426d46d5",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4198.0,
"function_hash": "13869530684771232947420133431342059840"
},
"id": "CVE-2024-39480-e4b96107",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f636a40834d22e5e3fc748f060211879c056cd33",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c"
},
"digest": {
"line_hashes": [
"212992467849131916074707001017904405072",
"225076245050643548704063748797632490996",
"281113771957278799290648690636321028431",
"110229926390997339995758324742639435157",
"287940665981418862373171352746125325107",
"186940434408367734604703032635157680907",
"120013084720437168379623052271142784436",
"150040407355262605878501273159737457792",
"26168114780086367036953427917531038450",
"162115234754261487050562237767139517415",
"50033897824448045756462340540162467362"
],
"threshold": 0.9
},
"id": "CVE-2024-39480-f06b7c64",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfdc2fa4db57503bc6d3817240547c8ddc55fa96",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "kernel/debug/kdb/kdb_io.c",
"function": "kdb_read"
},
"digest": {
"length": 4245.0,
"function_hash": "140648798559117336689012730137678828629"
},
"id": "CVE-2024-39480-f24f7e6b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd2972d8e2dee3b33e8121669d55def59f0be8a",
"deprecated": false,
"signature_type": "Function"
}
]