CVE-2023-54056
Description
A false positive buffer overflow detection was found in the Linux kernel's kheaders module. When CONFIG_FORTIFY_SOURCE is enabled, memcpy() performs size checks on source and destination buffers. The kernel_headers_data symbol was declared as "char" rather than an array, causing FORTIFY_SOURCE to incorrectly detect a buffer overflow when reading /sys/kernel/kheaders.tar.xz. The fix changes the declaration to an array type to match actual usage.
Statement
This is not a real security vulnerability but rather a FORTIFY_SOURCE false positive due to incorrect type declaration. The kheaders module exposes kernel headers as a compressed tarball via sysfs. The BUG is triggered by the defensive FORTIFY_SOURCE checks misinterpreting the buffer size, not by an actual overflow. Systems with CONFIG_IKHEADERS enabled may encounter this when reading the kheaders file.
Mitigation
To mitigate this issue, prevent the kheaders module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
