CVE-2024-42084: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42084 is a vulnerability discovered in the Linux kernel's ftruncate() syscall implementation. The issue was identified on July 29, 2024, affecting the old ftruncate() syscall when using the 32-bit off_t in compat mode on 64-bit architectures (NVD, Ubuntu).

The vulnerability stems from a missing sign extension in the ftruncate() syscall when called in compat mode on 64-bit architectures. When passing a negative length, the syscall accidentally succeeds in truncating files to sizes between 2GiB and 4GiB, instead of returning an error as expected. The native entry point, the truncate() syscall, and the corresponding loff_t based variants are not affected by this issue (Kernel Commit).

The vulnerability allows an attacker to successfully truncate files to sizes between 2GiB and 4GiB when passing negative length values, which should normally be rejected with an -EINVAL error. This could potentially lead to unintended file size modifications in affected systems (NVD).

The vulnerability requires local access to the system and the ability to make syscalls. It specifically affects systems running in compat mode on 64-bit architectures. No known exploits in the wild have been reported (NVD).

The issue has been fixed by changing the type of the compat syscall to the signed compat_off_t, which properly handles negative values by returning -EINVAL. Updates have been released for various Linux distributions, including Ubuntu 24.04 LTS, 22.04 LTS, and 20.04 LTS (Ubuntu). Systems should be updated to the patched versions to mitigate this vulnerability.