CVE-2023-52464: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52464 is a vulnerability discovered in the Linux kernel's EDAC (Error Detection and Correction) ThunderX driver. The issue was identified in February 2024 and affects Linux kernel versions from 4.12.0 up to versions before 4.19.306, 5.4.268, 5.10.209, and 5.15.148. The vulnerability stems from an incorrect buffer size handling in the drivers/edac/thunderx_edac.c file (NVD).

The vulnerability arises from a misuse of the strncat() function in the thunderxocxcomthreadedisr function within the EDAC/thunderx driver. The code incorrectly specifies a bound equal to the destination size, which could lead to buffer overflow conditions. The issue occurs because the driver's author expected strncat() to behave like strlcat(), using the destination buffer size as its third argument rather than the length of the source buffer. This results in no proper check on the allocated buffer size (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to out-of-bounds memory access in the Linux kernel's EDAC ThunderX driver. This could result in privilege escalation, denial of service, or information disclosure on affected systems (NVD).

The vulnerability has been fixed by replacing strncat() with strlcat() in the affected code. The fix has been backported to multiple kernel versions and is available in Linux kernel versions 4.19.306, 5.4.268, 5.10.209, and 5.15.148 or later. Various Linux distributions have released security updates to address this vulnerability, including Debian and Red Hat (Debian LTS, Red Hat).