CVE-2023-54056

A false positive buffer overflow detection was found in the Linux kernel's kheaders module. When CONFIG_FORTIFY_SOURCE is enabled, memcpy() performs size checks on source and destination buffers. The kernel_headers_data symbol was declared as "char" rather than an array, causing FORTIFY_SOURCE to incorrectly detect a buffer overflow when reading /sys/kernel/kheaders.tar.xz. The fix changes the declaration to an array type to match actual usage.

This is not a real security vulnerability but rather a FORTIFY_SOURCE false positive due to incorrect type declaration. The kheaders module exposes kernel headers as a compressed tarball via sysfs. The BUG is triggered by the defensive FORTIFY_SOURCE checks misinterpreting the buffer size, not by an actual overflow. Systems with CONFIG_IKHEADERS enabled may encounter this when reading the kheaders file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the kheaders module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.