CVE-2024-35878

What it actually does

of_modalias() can pass a NULL str pointer with nonzero len or a negative len value to vsnprintf(), causing a kernel oops because vsnprintf() requires len==0 when str is NULL and treats ssize_t negative values as enormous size_t buffers.

Why it matters to the business

Kernel panic or denial of service on systems that invoke of_modalias() with malformed parameters, potentially halting device initialization or module loading and affecting availability of Linux-based platforms.

How an attack unfolds

An attacker supplies crafted device-tree properties or triggers module alias resolution paths that reach of_modalias() with a NULL string pointer and nonzero length or a negative length, causing vsnprintf() to dereference invalid memory and crash the kernel.

How to fix it

Apply the upstream fix in commit e4a449368a2ce6d57a775d0ead27fc07f5a86e5b or later; update to a Linux kernel release containing this commit. Rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e4a449368a2ce6d57a775d0ead27fc07f5a86e5b or verify the of_modalias() implementation rejects NULL/nonzero and negative len values before calling vsnprintf().

Typical attack path

1. Identify or control input that reaches of_modalias() during device-tree parsing or modalias generation
2. Pass a NULL str pointer accompanied by a positive len or a negative len value
3. Trigger vsnprintf() with the invalid arguments resulting in NULL dereference or huge buffer allocation
4. Cause kernel oops and system instability or reboot

How to detect it

Review kernel logs for oops or panic messages containing vsnprintf or of_modalias; correlate with device-tree parsing or module loading events around the time of the crash.

What your security team should do

• Prioritize patching production kernels that parse device-tree data or load modules
• Test the fixed kernel in staging environments before broad rollout
• Monitor for kernel oops reports referencing vsnprintf or of_modalias after upgrade