CVE-2024-42084

What it actually does

In compat mode on 64-bit architectures the 32-bit off_t ftruncate syscall lacks sign extension, so a negative length value is treated as a large positive offset and the call succeeds in truncating the file to a size between 2 GiB and 4 GiB instead of returning -EINVAL.

Why it matters to the business

Unexpected file truncation can cause data loss, application crashes, or corruption of files that straddle the 2-4 GiB boundary, affecting stability of Linux-based servers, containers, and embedded devices that run 32-bit binaries.

How an attack unfolds

An attacker capable of executing code in a 32-bit compat process on a 64-bit kernel invokes the legacy ftruncate syscall with a negative length argument; the missing sign extension converts the value to a positive offset in the 2-4 GiB range, allowing the file to be silently resized rather than rejected with an error. Threat actors noted in Linux kernel exploitation campaigns could chain this behavior with other kernel flaws to achieve unexpected file-system state changes.

How to fix it

Upgrade the Linux kernel to a version containing commit c329760749b5419769e57cb2be80955d2805f9c9 or later; rebuild and reboot all affected systems. Where immediate patching is not possible, restrict execution of 32-bit binaries or audit calls to ftruncate from compat processes.

How to confirm the fix worked

Confirm the running kernel contains commit c329760749b5419769e57cb2be80955d2805f9c9, then verify that a 32-bit ftruncate call with a negative length now correctly returns -EINVAL instead of succeeding.

Typical attack path

1. Obtain execution in a 32-bit process on a 64-bit Linux kernel
2. Locate or create a file whose current size is below 2 GiB
3. Invoke the compat ftruncate entry point with a negative offset value
4. Observe successful truncation to a size between 2 GiB and 4 GiB
5. Leverage resulting file state for follow-on impact such as denial of service or data corruption

How to detect it

Review system call audit logs or eBPF traces for ftruncate invocations originating from 32-bit processes that target files whose resulting size falls in the 2-4 GiB range; correlate with application error logs showing unexpected file-size changes after the published date.

What your security team should do

• Prioritize kernel updates on all 64-bit systems that support 32-bit compat binaries
• Inventory workloads that still rely on 32-bit user-space binaries and plan migration
• Add kernel version checks to vulnerability scanning and patch-management pipelines
• Monitor upstream stable kernel releases for additional related fixes