CVE-2024-44966

What it actually does

The vulnerability causes corruption of sizeof(long) bytes immediately before the DATA segment (typically the end of the TEXT segment) because the shared library pointer array initialization code runs even when CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET is set and no space was reserved for the array.

Why it matters to the business

Affected Linux systems, particularly RISC-V configurations, may experience memory corruption leading to crashes, unpredictable behavior, or potential code execution during execution of FLAT binaries, increasing operational risk and requiring urgent patching across the ecosystem.

How an attack unfolds

An attacker supplies a specially crafted FLAT binary that triggers the unconditional initialization of the shared library pointer region; when the binary is loaded via binfmt_flat on a vulnerable kernel, the write occurs outside the allocated region, corrupting adjacent memory and enabling further attacker-controlled actions. Threat actor campaigns involving Linux kernel memory issues have been observed exploiting similar patterns.

How to fix it

Update to a kernel containing commit 3a684499261d0f7ed5ee72793025c88c2276809c which introduces the MAX_SHARED_LIBS_UPDATE guard; for affected Go packages update github.com/lestrrat-go/jwx to 1.2.26 or github.com/lestrrat-go/jwx/v2 to 2.0.11 if those components are in use.

How to confirm the fix worked

Verify the presence of the MAX_SHARED_LIBS_UPDATE conditional in binfmt_flat.c and confirm that the shared library pointer initialization is skipped when CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET is enabled; test loading of FLAT binaries on patched versus unpatched kernels.

Typical attack path

1. Identify or build a target system running an unpatched Linux kernel with BINFMT_FLAT support
2. Craft or obtain a malicious FLAT binary that exercises the un-guarded shared library pointer initialization path
3. Cause the victim process or system component to load and execute the binary
4. Leverage the resulting memory corruption to achieve code execution or denial of service

How to detect it

Search kernel logs and crash reports for binfmt_flat related faults or corruption near the TEXT/DATA boundary; review process execution history for unexpected FLAT binary loads and correlate with threat actor activity involving Linux kernel memory issues.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all RISC-V and other BINFMT_FLAT-enabled systems
• Review and restrict execution of untrusted FLAT binaries until patches are applied
• Monitor for memory corruption symptoms in processes that use the FLAT loader
• Track downstream kernel distributions for availability of the fix