CVE-2024-35803

What it actually does

Buffer overflow in x86 EFI stub mixed-mode boot path due to 16k decompressor stack placed adjacent to BSS/.data, allowing EFI boot service calls to corrupt kernel data structures instead of using the required 128k firmware stack.

Why it matters to the business

Rare but possible boot-time instability or memory corruption on legacy x86 mixed-mode EFI systems running affected Linux kernels; low prevalence reduces overall operational risk yet still requires patching for any remaining mixed-mode deployments.

How an attack unfolds

An attacker with ability to influence the 32-bit EFI entry point or bootloader environment triggers repeated EFI boot service calls that exceed the 16k stack allocation, overwriting adjacent kernel data; the bug was introduced when heap symbols moved into C code and remains exploitable only during early boot on mixed-mode hardware.

How to fix it

Upgrade Linux kernel to commit 2149f8a56e2ed345c7a4d022a79f6b8fc53ae926 or later stable releases that record and switch to the firmware stack pointer for all EFI boot service calls in mixed mode.

How to confirm the fix worked

Verify kernel source contains the firmware stack pointer recording logic before any EFI service calls; confirm boot logs no longer show mixed-mode stack usage warnings and test mixed-mode boot on representative hardware.

Typical attack path

1. Gain control of bootloader or 32-bit EFI entry environment
2. Force EFI stub to invoke boot services while running on the limited 16k decompressor stack
3. Trigger stack growth sufficient to overrun into .data section
4. Corrupt kernel data structures during boot to achieve denial of service or limited code execution

How to detect it

Examine early boot logs and EFI stub output for signs of stack-related corruption or unexpected data overwrites; review bootloader configurations for mixed-mode usage and correlate with kernel panic artifacts referencing EFI or decompressor stack regions.

What your security team should do

• Prioritize upgrade of any x86 mixed-mode EFI systems to the fixed commit within standard change windows
• Disable mixed-mode boot where possible by enforcing native 64-bit EFI firmware
• Add kernel version checks to asset inventory for affected stable branches