CVE-2024-27413

What it actually does

On 32-bit architectures the efi_capsule_open function allocates only 4 bytes (sizeof(void *)) for a phys_addr_t field that requires 8 bytes, resulting in an undersized buffer that is later written with a 64-bit physical address and produces memory corruption.

Why it matters to the business

Systems running 32-bit Linux kernels that use EFI capsule loading may experience crashes, denial of service, or unpredictable kernel behavior until the kernel is updated.

How an attack unfolds

An attacker with local access triggers the EFI capsule loader path so that efi_capsule_open performs the undersized kzalloc; the subsequent write of a 64-bit phys_addr_t then overwrites adjacent kernel memory, potentially leading to a crash or limited code execution within the kernel.

How to fix it

Update the Linux kernel to a version containing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff or later; rebuild and reboot with the corrected driver/firmware/efi/capsule-loader.c that uses sizeof(phys_addr_t) for the allocation.

How to confirm the fix worked

Compile the updated kernel with gcc-14 (or equivalent) and confirm the allocation warning is absent; verify the source line now reads kzalloc(sizeof(phys_addr_t), GFP_KERNEL); test capsule loading on 32-bit EFI hardware.

Typical attack path

1. Obtain local user privileges on a 32-bit Linux system with EFI support
2. Invoke the EFI capsule loader interface to open a capsule
3. Trigger the undersized allocation in efi_capsule_open
4. Cause the phys_addr_t write to corrupt adjacent kernel structures
5. Escalate to kernel crash or limited code execution

How to detect it

Examine kernel logs for allocation-size warnings or oopses originating from drivers/firmware/efi/capsule-loader.c around the time of capsule operations; correlate with dmesg entries mentioning phys_addr_t or efi_capsule_open.

What your security team should do

• Prioritize kernel upgrades on all 32-bit EFI systems within the next maintenance window
• Add the fixed commit hash to internal patch-monitoring rules
• Review any downstream distributions or embedded products that ship the affected capsule-loader code
• Disable EFI capsule loading if the functionality is unused and the update cannot be applied promptly