In the Linux kernel, the following vulnerability has been resolved:
kdb: Fix buffer overflow during tab-complete
Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer.
Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4198.0, "function_hash": "13869530684771232947420133431342059840" }, "id": "CVE-2024-39480-1caacbde", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d9c814652b971461d1e30bead6792851c209e7" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-44d3cba5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f636a40834d22e5e3fc748f060211879c056cd33" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4208.0, "function_hash": "30976790032925482321940147679410440935" }, "id": "CVE-2024-39480-54793acf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9730744bf3af04cda23799029342aa3cddbc454" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4208.0, "function_hash": "30976790032925482321940147679410440935" }, "id": "CVE-2024-39480-5b754693", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@107e825cc448b7834b31e8b1b3cf0f57426d46d5" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-77086f6e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb824a99e148ff272a53d71d84122728b5f00992" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-834ab3ed", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d9c814652b971461d1e30bead6792851c209e7" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4245.0, "function_hash": "140648798559117336689012730137678828629" }, "id": "CVE-2024-39480-87fd8199", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb824a99e148ff272a53d71d84122728b5f00992" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4198.0, "function_hash": "13869530684771232947420133431342059840" }, "id": "CVE-2024-39480-8b3d39e2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfdc2fa4db57503bc6d3817240547c8ddc55fa96" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-90c248fe", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f694da720dcf795dc3eb97bf76d220213f76aaa7" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4208.0, "function_hash": "30976790032925482321940147679410440935" }, "id": "CVE-2024-39480-90dc40f8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f694da720dcf795dc3eb97bf76d220213f76aaa7" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-97218a0e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9730744bf3af04cda23799029342aa3cddbc454" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-9f147f25", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd2972d8e2dee3b33e8121669d55def59f0be8a" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-d55cd895", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@107e825cc448b7834b31e8b1b3cf0f57426d46d5" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4198.0, "function_hash": "13869530684771232947420133431342059840" }, "id": "CVE-2024-39480-e4b96107", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f636a40834d22e5e3fc748f060211879c056cd33" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/debug/kdb/kdb_io.c" }, "deprecated": false, "digest": { "line_hashes": [ "212992467849131916074707001017904405072", "225076245050643548704063748797632490996", "281113771957278799290648690636321028431", "110229926390997339995758324742639435157", "287940665981418862373171352746125325107", "186940434408367734604703032635157680907", "120013084720437168379623052271142784436", "150040407355262605878501273159737457792", "26168114780086367036953427917531038450", "162115234754261487050562237767139517415", "50033897824448045756462340540162467362" ], "threshold": 0.9 }, "id": "CVE-2024-39480-f06b7c64", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfdc2fa4db57503bc6d3817240547c8ddc55fa96" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/debug/kdb/kdb_io.c", "function": "kdb_read" }, "deprecated": false, "digest": { "length": 4245.0, "function_hash": "140648798559117336689012730137678828629" }, "id": "CVE-2024-39480-f24f7e6b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddd2972d8e2dee3b33e8121669d55def59f0be8a" } ] }