Oracle Linux: CVE-2024-42084: ELSA-2024-12610: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-42084: ELSA-2024-12610: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:H/Au:M/C:C/I:C/A:N)

Published

07/29/2024

Created

10/18/2024

Added

10/16/2024

Modified

01/23/2025

Description

In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures.As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.

Solution(s)

• oracle-linux-upgrade-kernel
• oracle-linux-upgrade-kernel-uek

References

• https://attackerkb.com/topics/cve-2024-42084
• CVE - 2024-42084
• ELSA-2024-12610
• ELSA-2024-12618
• ELSA-2024-12779
• ELSA-2024-7000
• ELSA-2024-12612