Junglewise Threat Intelligence

CVE-2024-50131: Linux Kernel buffer overflow in tracing probe event parsing

CVE-2024-50131 · Severity: high · CVSS 7.8 · Published 2024-11-05

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's tracing component, which is used by developers and system administrators to monitor system behavior. A flaw in how the system validates the length of event names could allow a local user to cause a buffer overflow. This could potentially lead to a system crash or allow an attacker to gain elevated privileges on the affected machine.

Technical details

The vulnerability is a classic buffer overflow (CWE-120) located in 'kernel/trace/trace_probe.c' within the 'traceprobe_parse_event_name' function. The root cause is an off-by-one error where 'strlen()' is used to validate input against 'MAX_EVENT_NAME_LEN' without accounting for the required NULL terminating character. If the input string length exactly matches the maximum buffer size, the subsequent copy operation will lack space for the terminator, leading to memory corruption. This is reachable by local users interacting with the kernel's tracing/probe interface. Patches have been released across multiple stable kernel branches (5.15.y, 6.1.y, 6.6.y, 6.11.y).

Affected products

  • Linux Linux Kernel 5.1 to 5.15.170, 5.16 to 6.1.115, 6.2 to 6.6.59, 6.7 to 6.11.6, 6.12-rc1 to 6.12-rc4

Timeline

  • 2024-11-05: disclosed: Initial publication of the CVE record
  • 2024-11-05: advisory: NVD published date
  • 2024-10-23: patched: Mainline kernel patch committed

References

Related threats