Google: sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6: security update to 18613.75.89

high Tenable Self-Hosted Container Security Plugin ID 466190

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer
overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-
format.rst as: 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55
============= ================== ========================= 56 Field name Field size Meaning 57
============= ================== ========================= ... 70 c_namesize 8 bytes Length of filename,
including final \0 When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes
a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod(). If
a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized
memory, then a file may be created with trailing characters that represent the uninitialized memory. The
ability to create an initramfs entry would imply already having full control of the system, so the buffer
overrun shouldn't be considered a security vulnerability. Append the output of the following bash script
to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g.
./reproducer.sh | gzip >> /myinitramfs It's easiest to observe non-zero uninitialized memory when the
output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the
initrd_start+initrd_size block. ---- reproducer.sh ---- nilchar="A" # change to "\0" to properly zero
terminate / pad magic="070701" ino=1 mode=$(( 0100777 )) uid=0 gid=0 nlink=1 mtime=1 filesize=0 devmajor=0
devminor=1 rdevmajor=0 rdevminor=0 csum=0 fname="initramfs_test_fname_overrun" namelen=$(( ${#fname} + 1
)) # plus one to account for terminator printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s"
\ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen
$csum $fname termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1
$termpadlen) ---- reproducer.sh ---- Symlink filename fields handled in do_symlink() won't overrun past
the data segment, due to the explicit zero-termination of the symlink target. Fix filename buffer overrun
by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len
- 1) offset. (CVE-2024-53142)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 18613.75.89 or later.

Plugin Details

Severity: High

ID: 466190

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-53142

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 12/6/2024

Reference Information

CVE: CVE-2024-53142

Detections

Analytics