CVE-2023-52464

What it actually does

Incorrect use of strncat() in the thunderx_edac driver treats the third argument as source length instead of remaining destination buffer space, allowing unbounded writes into a fixed-size message buffer and resulting in out-of-bounds memory corruption.

Why it matters to the business

Local users on affected Linux systems can trigger kernel memory corruption that may lead to crashes, privilege escalation, or denial of service, requiring urgent kernel updates across server fleets and embedded devices.

How an attack unfolds

An attacker with local access invokes the OCX interrupt handler paths that call strncat() repeatedly with attacker-controlled or large 'other' strings; because the destination size check is missing, the writes exceed the allocated buffer and corrupt adjacent kernel memory, enabling further exploitation such as code execution or system panic.

How to fix it

Update the Linux kernel to the commit 71c17ee02538802ceafc830f0736aa35b564e601 or later stable releases that replace strncat with strlcat in thunderx_edac.c; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains commit 71c17ee02538802ceafc830f0736aa35b564e601, compile the driver with -Wstringop-overflow to verify absence of the warning, and test that OCX interrupt paths no longer produce buffer overflows under load.

Typical attack path

1. Obtain local shell or user context on a system running a vulnerable kernel with the thunderx_edac driver loaded
2. Trigger the threaded ISR in drivers/edac/thunderx_edac.c by generating OCX-related hardware events or crafted input
3. Supply strings that exceed the implicit remaining buffer capacity to the strncat calls at lines 1136/1145/1150
4. Cause out-of-bounds writes that corrupt kernel structures and escalate privileges or crash the system

How to detect it

Review kernel logs for unexpected crashes or oops messages originating from thunderx_edac.c around OCX interrupt handling; correlate with local user activity preceding the event and examine core dumps for evidence of buffer overruns in the msg buffer.

What your security team should do

• Prioritize kernel upgrades on all systems exposing the thunderx_edac driver within the next patching cycle
• Add automated checks for the fixed commit hash in CI/CD kernel build pipelines
• Monitor vendor advisories for backported patches in distribution kernels