CVE-2024-53106

In the Linux kernel, the following vulnerability has been resolved:

ima: fix buffer overrun in ima_eventdigest_init_common

Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_digest_size[] leading to buffer overrun. Have a conditional statement to handle this.

This vulnerability is rated as Moderate because exploitation is restricted to local environments with high privileges, limiting the blast radius primarily to denial of service or kernel memory corruption. Red Hat Enterprise Linux is not affected as the flaw was introduced in an upstream kernel release newer than the versions maintained in supported enterprise products. Additionally, triggering the issue requires specific Integrity Measurement Architecture configurations that are not enabled by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.