CVE-2024-40994

What it actually does

Integer overflow during allocation size calculation in ptp max_vclocks_store on 32-bit systems when multiplying by 4, leading to undersized buffer and subsequent memory corruption.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on 32-bit Linux systems using PTP clock management, impacting time-sensitive applications and requiring urgent patching across large fleets.

How an attack unfolds

An attacker with local access supplies a large value to the max_vclocks sysfs attribute on a 32-bit kernel, triggering the overflowed allocation size; the subsequent write then corrupts adjacent kernel memory structures.

How to fix it

Upgrade the Linux kernel to the commit 4b03da87d0b7074c93d9662c6e1a8939f9b8b86e or later stable release containing the kcalloc fix; rebuild and reboot all affected 32-bit systems.

How to confirm the fix worked

Confirm kernel source contains the kcalloc change in ptp_clock.c, verify max_vclocks_store no longer performs direct 4*max arithmetic, and test on 32-bit hardware that large values no longer cause allocation failure.

Typical attack path

1. Identify 32-bit Linux kernel with PTP subsystem enabled
2. Obtain local unprivileged access
3. Write oversized value to /sys/class/ptp/ptp*/max_vclocks
4. Trigger allocation path that performs the 4*max multiply
5. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review kernel logs for allocation failures or warnings around ptp max_vclocks; inspect sysfs writes to PTP clock attributes and correlate with any subsequent oops or panic entries indicating memory corruption.

What your security team should do

• Prioritize patching all 32-bit Linux systems within maintenance windows
• Audit environments for remaining 32-bit PTP-enabled kernels
• Monitor for any local privilege-escalation attempts targeting kernel memory
• Plan migration off 32-bit platforms where feasible