CVE-2024-53142

What it actually does

The initramfs cpio handler in the Linux kernel assumes a zero-terminated filename at @collected and passes it directly to file operations; a crafted cpio entry without the terminator at (name_len-1) causes a filename buffer overrun into uninitialized memory, creating files with trailing characters from that memory.

Why it matters to the business

Although requiring prior full system control, exposure can produce unexpected files during initramfs extraction on Linux systems, impacting boot reliability and forensic cleanliness; high ecosystem prevalence increases operational exposure across many distributions.

How an attack unfolds

An attacker who already controls initramfs appends a specially crafted cpio entry lacking a zero terminator (using the provided reproducer pattern with non-zero padding), gzips it, and triggers extraction so that do_name() creates a file whose name extends into heap-allocated uninitialized memory; listed threat actors in 2024 zero-day and Linux kernel out-of-bounds campaigns highlight the pattern even though the issue is not treated as a security vulnerability.

How to fix it

Apply the kernel fix that aborts the initramfs FSM when any cpio entry lacks a zero terminator at the expected offset; for listed packages upgrade ruby2.3 (Ubuntu:16.04:LTS) to 2.3.1-2~ubuntu16.04.14, ruby-psych (Ubuntu:18.04:LTS) to 2.2.4-6build4, and ruby2.5 (Ubuntu:18.04:LTS) to 2.5.1-1ubuntu1.6.

How to confirm the fix worked

Confirm the kernel change that checks (name_len-1) for the terminator before processing; verify no /initramfs_test_fname_overrunAA* files appear after appending the reproducer to an initramfs and extracting.

Typical attack path

1. Obtain ability to modify or append to an initramfs archive
2. Generate cpio header with non-zero-terminated filename using the reproducer pattern
3. Append the entry (optionally gzipped to hit heap buffer) to the initramfs
4. Trigger kernel extraction during boot so do_name() processes the malformed entry
5. Observe resulting files with trailing characters from uninitialized memory

How to detect it

Search boot and extraction logs plus filesystem artifacts for files matching the reproducer pattern such as initramfs_test_fname_overrun with trailing characters; inspect initramfs contents before and after extraction on systems potentially exposed to the listed 2024 exploitation campaigns.

• initramfs_test_fname_overrun
• 070701
• nilchar=A
• /initramfs_test_fname_overrunAA

What your security team should do

• Prioritize kernel updates containing the FSM abort logic on all Linux systems that use initramfs
• Audit initramfs build pipelines to ensure all cpio entries are properly zero-terminated
• Monitor for unexpected files named with the reproducer pattern during boot or initramfs tests
• Treat as reliability issue rather than remote-exploitable vulnerability given the control prerequisite