GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50067 (GCVE-0-2024-50067)

Vulnerability from cvelistv5 – Published: 2024-10-28 00:57 – Updated: 2026-08-05 11:41
VLAI
Title
uprobe: avoid out-of-bounds memory access of fetching args
Summary
In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-space strings, arrays can be very large, but the size of percpu buffer is only page size. And store_trace_args() won't check whether these data exceeds a single page or not, caused out-of-bounds memory access. It could be reproduced by following steps: 1. build kernel with CONFIG_KASAN enabled 2. save follow program as test.c ``` \#include <stdio.h> \#include <stdlib.h> \#include <string.h> // If string length large than MAX_STRING_SIZE, the fetch_store_strlen() // will return 0, cause __get_data_size() return shorter size, and // store_trace_args() will not trigger out-of-bounds access. // So make string length less than 4096. \#define STRLEN 4093 void generate_string(char *str, int n) { int i; for (i = 0; i < n; ++i) { char c = i % 26 + 'a'; str[i] = c; } str[n-1] = '\0'; } void print_string(char *str) { printf("%s\n", str); } int main() { char tmp[STRLEN]; generate_string(tmp, STRLEN); print_string(tmp); return 0; } ``` 3. compile program `gcc -o test test.c` 4. get the offset of `print_string()` ``` objdump -t test | grep -w print_string 0000000000401199 g F .text 000000000000001b print_string ``` 5. configure uprobe with offset 0x1199 ``` off=0x1199 cd /sys/kernel/debug/tracing/ echo "p /root/test:${off} arg1=+0(%di):ustring arg2=\$comm arg3=+0(%di):ustring" > uprobe_events echo 1 > events/uprobes/enable echo 1 > tracing_on ``` 6. run `test`, and kasan will report error. ================================================================== BUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0 Write of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18 Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x27/0x310 kasan_report+0x10f/0x120 ? strncpy_from_user+0x1d6/0x1f0 strncpy_from_user+0x1d6/0x1f0 ? rmqueue.constprop.0+0x70d/0x2ad0 process_fetch_insn+0xb26/0x1470 ? __pfx_process_fetch_insn+0x10/0x10 ? _raw_spin_lock+0x85/0xe0 ? __pfx__raw_spin_lock+0x10/0x10 ? __pte_offset_map+0x1f/0x2d0 ? unwind_next_frame+0xc5f/0x1f80 ? arch_stack_walk+0x68/0xf0 ? is_bpf_text_address+0x23/0x30 ? kernel_text_address.part.0+0xbb/0xd0 ? __kernel_text_address+0x66/0xb0 ? unwind_get_return_address+0x5e/0xa0 ? __pfx_stack_trace_consume_entry+0x10/0x10 ? arch_stack_walk+0xa2/0xf0 ? _raw_spin_lock_irqsave+0x8b/0xf0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? depot_alloc_stack+0x4c/0x1f0 ? _raw_spin_unlock_irqrestore+0xe/0x30 ? stack_depot_save_flags+0x35d/0x4f0 ? kasan_save_stack+0x34/0x50 ? kasan_save_stack+0x24/0x50 ? mutex_lock+0x91/0xe0 ? __pfx_mutex_lock+0x10/0x10 prepare_uprobe_buffer.part.0+0x2cd/0x500 uprobe_dispatcher+0x2c3/0x6a0 ? __pfx_uprobe_dispatcher+0x10/0x10 ? __kasan_slab_alloc+0x4d/0x90 handler_chain+0xdd/0x3e0 handle_swbp+0x26e/0x3d0 ? __pfx_handle_swbp+0x10/0x10 ? uprobe_pre_sstep_notifier+0x151/0x1b0 irqentry_exit_to_user_mode+0xe2/0x1b0 asm_exc_int3+0x39/0x40 RIP: 0033:0x401199 Code: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce RSP: 002b:00007ffdf00576a8 EFLAGS: 00000206 RAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2 RDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0 RBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20 R10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040 R13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000 </TASK> This commit enforces the buffer's maxlen less than a page-size to avoid store_trace_args() out-of-memory access.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-11 14:49 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dcad1a204f72624796ae83359403898d10393b9c , < 0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f (git)
Affected: dcad1a204f72624796ae83359403898d10393b9c , < 9e5f93788c9dd4309e75a56860a1ac44a8e117b9 (git)
Affected: dcad1a204f72624796ae83359403898d10393b9c , < 537ad4a431f6dddbf15d40d19f24bb9ee12b55cb (git)
Affected: dcad1a204f72624796ae83359403898d10393b9c , < 373b9338c9722a368925d83bc622c596896b328e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 6.1.118 , ≤ 6.1.* (semver)
Unaffected: 6.6.59 , ≤ 6.6.* (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50067",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:49:09.097229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:58:34.869Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:25:03.914Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_uprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f",
              "status": "affected",
              "version": "dcad1a204f72624796ae83359403898d10393b9c",
              "versionType": "git"
            },
            {
              "lessThan": "9e5f93788c9dd4309e75a56860a1ac44a8e117b9",
              "status": "affected",
              "version": "dcad1a204f72624796ae83359403898d10393b9c",
              "versionType": "git"
            },
            {
              "lessThan": "537ad4a431f6dddbf15d40d19f24bb9ee12b55cb",
              "status": "affected",
              "version": "dcad1a204f72624796ae83359403898d10393b9c",
              "versionType": "git"
            },
            {
              "lessThan": "373b9338c9722a368925d83bc622c596896b328e",
              "status": "affected",
              "version": "dcad1a204f72624796ae83359403898d10393b9c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_uprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.118",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobe: avoid out-of-bounds memory access of fetching args\n\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\nbuffer to avoid non-atomic context problem.\n\nSometimes user-space strings, arrays can be very large, but the size of\npercpu buffer is only page size. And store_trace_args() won\u0027t check\nwhether these data exceeds a single page or not, caused out-of-bounds\nmemory access.\n\nIt could be reproduced by following steps:\n1. build kernel with CONFIG_KASAN enabled\n2. save follow program as test.c\n\n```\n\\#include \u003cstdio.h\u003e\n\\#include \u003cstdlib.h\u003e\n\\#include \u003cstring.h\u003e\n\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\n// will return 0, cause __get_data_size() return shorter size, and\n// store_trace_args() will not trigger out-of-bounds access.\n// So make string length less than 4096.\n\\#define STRLEN 4093\n\nvoid generate_string(char *str, int n)\n{\n    int i;\n    for (i = 0; i \u003c n; ++i)\n    {\n        char c = i % 26 + \u0027a\u0027;\n        str[i] = c;\n    }\n    str[n-1] = \u0027\\0\u0027;\n}\n\nvoid print_string(char *str)\n{\n    printf(\"%s\\n\", str);\n}\n\nint main()\n{\n    char tmp[STRLEN];\n\n    generate_string(tmp, STRLEN);\n    print_string(tmp);\n\n    return 0;\n}\n```\n3. compile program\n`gcc -o test test.c`\n\n4. get the offset of `print_string()`\n```\nobjdump -t test | grep -w print_string\n0000000000401199 g     F .text  000000000000001b              print_string\n```\n\n5. configure uprobe with offset 0x1199\n```\noff=0x1199\n\ncd /sys/kernel/debug/tracing/\necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\"\n \u003e uprobe_events\necho 1 \u003e events/uprobes/enable\necho 1 \u003e tracing_on\n```\n\n6. run `test`, and kasan will report error.\n==================================================================\nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0\nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x55/0x70\n print_address_description.constprop.0+0x27/0x310\n kasan_report+0x10f/0x120\n ? strncpy_from_user+0x1d6/0x1f0\n strncpy_from_user+0x1d6/0x1f0\n ? rmqueue.constprop.0+0x70d/0x2ad0\n process_fetch_insn+0xb26/0x1470\n ? __pfx_process_fetch_insn+0x10/0x10\n ? _raw_spin_lock+0x85/0xe0\n ? __pfx__raw_spin_lock+0x10/0x10\n ? __pte_offset_map+0x1f/0x2d0\n ? unwind_next_frame+0xc5f/0x1f80\n ? arch_stack_walk+0x68/0xf0\n ? is_bpf_text_address+0x23/0x30\n ? kernel_text_address.part.0+0xbb/0xd0\n ? __kernel_text_address+0x66/0xb0\n ? unwind_get_return_address+0x5e/0xa0\n ? __pfx_stack_trace_consume_entry+0x10/0x10\n ? arch_stack_walk+0xa2/0xf0\n ? _raw_spin_lock_irqsave+0x8b/0xf0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? depot_alloc_stack+0x4c/0x1f0\n ? _raw_spin_unlock_irqrestore+0xe/0x30\n ? stack_depot_save_flags+0x35d/0x4f0\n ? kasan_save_stack+0x34/0x50\n ? kasan_save_stack+0x24/0x50\n ? mutex_lock+0x91/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n prepare_uprobe_buffer.part.0+0x2cd/0x500\n uprobe_dispatcher+0x2c3/0x6a0\n ? __pfx_uprobe_dispatcher+0x10/0x10\n ? __kasan_slab_alloc+0x4d/0x90\n handler_chain+0xdd/0x3e0\n handle_swbp+0x26e/0x3d0\n ? __pfx_handle_swbp+0x10/0x10\n ? uprobe_pre_sstep_notifier+0x151/0x1b0\n irqentry_exit_to_user_mode+0xe2/0x1b0\n asm_exc_int3+0x39/0x40\nRIP: 0033:0x401199\nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce\nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206\nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2\nRDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0\nRBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20\nR10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040\nR13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\n\nThis commit enforces the buffer\u0027s maxlen less than a page-size to avoid\nstore_trace_args() out-of-memory access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven by a uprobe firing on a locally executing process, whose registers and user-space string data supply the oversized fetch arguments. No network or physical vector is involved; the attacker needs local code execution.\nAC:L - The traced process fully controls both the length and content of the fetched strings, so exceeding PAGE_SIZE is deterministic and repeatable \u2014 a single 4095-byte string already overflows, and the reporter supplies a trivial reproducer.\nPR:L - The out-of-bounds write is performed on behalf of the ordinary unprivileged process that hits the uprobe, using data it fully controls; the probe configuration is an environmental precondition of routine production tracing, not a privilege the attacker exercises. Some deployments also grant tracefs write access to a non-root tracing group.\nUI:N - The attacker triggers the bug by running the instrumented binary itself with long string arguments; no victim action is required as part of the attack.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 standard local privilege escalation, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The perf path memcpy\u0027s up to ~4 KB beyond the per-CPU page into trace records, disclosing adjacent kernel memory, and the controlled OOB write is readily leveraged into an arbitrary-read primitive by corrupting neighboring kernel objects.\nI:H - This is an out-of-bounds write with attacker-chosen length and fully attacker-chosen bytes past a page-sized buffer, corrupting whatever adjacent buddy page holds (slab objects, page tables, stacks) \u2014 a direct path to control-flow hijack and privilege escalation.\nA:H - Smashing adjacent kernel pages with arbitrary user data reliably produces oopses and panics, as demonstrated by the KASAN splat in the fix commit, and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:22.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e5f93788c9dd4309e75a56860a1ac44a8e117b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/537ad4a431f6dddbf15d40d19f24bb9ee12b55cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/373b9338c9722a368925d83bc622c596896b328e"
        }
      ],
      "title": "uprobe: avoid out-of-bounds memory access of fetching args",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50067",
    "datePublished": "2024-10-28T00:57:05.734Z",
    "dateReserved": "2024-10-21T19:36:19.939Z",
    "dateUpdated": "2026-08-05T11:41:22.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50067",
      "date": "2026-09-04",
      "epss": "0.00235",
      "percentile": "0.14342"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50067\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-28T01:15:02.930\",\"lastModified\":\"2026-06-18T14:30:19.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nuprobe: avoid out-of-bounds memory access of fetching args\\n\\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\\nbuffer to avoid non-atomic context problem.\\n\\nSometimes user-space strings, arrays can be very large, but the size of\\npercpu buffer is only page size. And store_trace_args() won\u0027t check\\nwhether these data exceeds a single page or not, caused out-of-bounds\\nmemory access.\\n\\nIt could be reproduced by following steps:\\n1. build kernel with CONFIG_KASAN enabled\\n2. save follow program as test.c\\n\\n```\\n\\\\#include \u003cstdio.h\u003e\\n\\\\#include \u003cstdlib.h\u003e\\n\\\\#include \u003cstring.h\u003e\\n\\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\\n// will return 0, cause __get_data_size() return shorter size, and\\n// store_trace_args() will not trigger out-of-bounds access.\\n// So make string length less than 4096.\\n\\\\#define STRLEN 4093\\n\\nvoid generate_string(char *str, int n)\\n{\\n    int i;\\n    for (i = 0; i \u003c n; ++i)\\n    {\\n        char c = i % 26 + \u0027a\u0027;\\n        str[i] = c;\\n    }\\n    str[n-1] = \u0027\\\\0\u0027;\\n}\\n\\nvoid print_string(char *str)\\n{\\n    printf(\\\"%s\\\\n\\\", str);\\n}\\n\\nint main()\\n{\\n    char tmp[STRLEN];\\n\\n    generate_string(tmp, STRLEN);\\n    print_string(tmp);\\n\\n    return 0;\\n}\\n```\\n3. compile program\\n`gcc -o test test.c`\\n\\n4. get the offset of `print_string()`\\n```\\nobjdump -t test | grep -w print_string\\n0000000000401199 g     F .text  000000000000001b              print_string\\n```\\n\\n5. configure uprobe with offset 0x1199\\n```\\noff=0x1199\\n\\ncd /sys/kernel/debug/tracing/\\necho \\\"p /root/test:${off} arg1=+0(%di):ustring arg2=\\\\$comm arg3=+0(%di):ustring\\\"\\n \u003e uprobe_events\\necho 1 \u003e events/uprobes/enable\\necho 1 \u003e tracing_on\\n```\\n\\n6. run `test`, and kasan will report error.\\n==================================================================\\nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0\\nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18\\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x55/0x70\\n print_address_description.constprop.0+0x27/0x310\\n kasan_report+0x10f/0x120\\n ? strncpy_from_user+0x1d6/0x1f0\\n strncpy_from_user+0x1d6/0x1f0\\n ? rmqueue.constprop.0+0x70d/0x2ad0\\n process_fetch_insn+0xb26/0x1470\\n ? __pfx_process_fetch_insn+0x10/0x10\\n ? _raw_spin_lock+0x85/0xe0\\n ? __pfx__raw_spin_lock+0x10/0x10\\n ? __pte_offset_map+0x1f/0x2d0\\n ? unwind_next_frame+0xc5f/0x1f80\\n ? arch_stack_walk+0x68/0xf0\\n ? is_bpf_text_address+0x23/0x30\\n ? kernel_text_address.part.0+0xbb/0xd0\\n ? __kernel_text_address+0x66/0xb0\\n ? unwind_get_return_address+0x5e/0xa0\\n ? __pfx_stack_trace_consume_entry+0x10/0x10\\n ? arch_stack_walk+0xa2/0xf0\\n ? _raw_spin_lock_irqsave+0x8b/0xf0\\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n ? depot_alloc_stack+0x4c/0x1f0\\n ? _raw_spin_unlock_irqrestore+0xe/0x30\\n ? stack_depot_save_flags+0x35d/0x4f0\\n ? kasan_save_stack+0x34/0x50\\n ? kasan_save_stack+0x24/0x50\\n ? mutex_lock+0x91/0xe0\\n ? __pfx_mutex_lock+0x10/0x10\\n prepare_uprobe_buffer.part.0+0x2cd/0x500\\n uprobe_dispatcher+0x2c3/0x6a0\\n ? __pfx_uprobe_dispatcher+0x10/0x10\\n ? __kasan_slab_alloc+0x4d/0x90\\n handler_chain+0xdd/0x3e0\\n handle_swbp+0x26e/0x3d0\\n ? __pfx_handle_swbp+0x10/0x10\\n ? uprobe_pre_sstep_notifier+0x151/0x1b0\\n irqentry_exit_to_user_mode+0xe2/0x1b0\\n asm_exc_int3+0x39/0x40\\nRIP: 0033:0x401199\\nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce\\nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206\\nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2\\nRDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0\\nRBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20\\nR10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040\\nR13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000\\n \u003c/TASK\u003e\\n\\nThis commit enforces the buffer\u0027s maxlen less than a page-size to avoid\\nstore_trace_args() out-of-memory access.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: uprobe: evitar el acceso a memoria fuera de los l\u00edmites para obtener argumentos. Uprobe necesita obtener argumentos en un b\u00fafer por CPU y luego copiarlos en el b\u00fafer de anillo para evitar problemas de contexto no at\u00f3mico. A veces, las cadenas y matrices del espacio de usuario pueden ser muy grandes, pero el tama\u00f1o del b\u00fafer por CPU es solo el tama\u00f1o de la p\u00e1gina. Y store_trace_args() no verificar\u00e1 si estos datos exceden una sola p\u00e1gina o no, lo que provoc\u00f3 un acceso a memoria fuera de los l\u00edmites. Se puede reproducir siguiendo los pasos: 1. compilar el kernel con CONFIG_KASAN habilitado 2. guardar el siguiente programa como test.c ``` \\\\#include  \\\\#include  \\\\#include  // Si la longitud de la cadena es mayor que MAX_STRING_SIZE, fetch_store_strlen() // devolver\u00e1 0, lo que har\u00e1 que __get_data_size() devuelva un tama\u00f1o menor y // store_trace_args() no active el acceso fuera de los l\u00edmites. // Entonces haga que la longitud de la cadena sea menor que 4096. \\\\#define STRLEN 4093 void generate_string(char *str, int n) { int i; for (i = 0; i \u0026lt; n; ++i) { char c = i % 26 + \u0027a\u0027; str[i] = c; } str[n-1] = \u0027\\\\0\u0027; } void print_string(char *str) { printf(\\\"%s\\\\n\\\", str); } int main() { char tmp[STRLEN]; generate_string(tmp, STRLEN); print_string(tmp); return 0; } ``` 3. compilar el programa `gcc -o test test.c` 4. obtener el desplazamiento de `print_string()` ``` objdump -t test | grep -w print_string 0000000000401199 g F .text 000000000000001b print_string ``` 5. configure uprobe con desplazamiento 0x1199 ``` off=0x1199 cd /sys/kernel/debug/tracing/ echo \\\"p /root/test:${off} arg1=+0(%di):ustring arg2=\\\\$comm arg3=+0(%di):ustring\\\" \u0026gt; uprobe_events echo 1 \u0026gt; events/uprobes/enable echo 1 \u0026gt; tracing_on ``` 6. ejecute `test` y kasan informar\u00e1 el error. ===================================================================== ERROR: KASAN: use-after-free en strncpy_from_user+0x1d6/0x1f0 Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff88812311c004 por la tarea test/499CPU: 0 UID: 0 PID: 499 Comm: test No contaminado 6.12.0-rc3+ #18 Nombre del hardware: Red Hat KVM, BIOS 1.16.0-4.al8 01/04/2014 Rastreo de llamadas:  dump_stack_lvl+0x55/0x70 descripci\u00f3n_direcci\u00f3n_impresi\u00f3n.constprop.0+0x27/0x310 informe_kasan+0x10f/0x120 ? strncpy_desde_usuario+0x1d6/0x1f0 strncpy_desde_usuario+0x1d6/0x1f0 ? rmqueue.constprop.0+0x70d/0x2ad0 inserci\u00f3n_obtenci\u00f3n_proceso+0xb26/0x1470 ? __pfx_instrucci\u00f3n_obtenci\u00f3n_proceso+0x10/0x10 ? _bloqueo_giro_sin_procesamiento+0x85/0xe0 ? __pfx__bloqueo_giro_sin_procesamiento+0x10/0x10 ? __pte_offset_map+0x1f/0x2d0 ? desenrollar_siguiente_fotograma+0xc5f/0x1f80 ? arch_stack_walk+0x68/0xf0 ? is_bpf_text_address+0x23/0x30 ? kernel_text_address.part.0+0xbb/0xd0 ? __kernel_text_address+0x66/0xb0 ? unwind_get_return_address+0x5e/0xa0 ? __pfx_stack_trace_consume_entry+0x10/0x10 ? arch_stack_walk+0xa2/0xf0 ? _raw_spin_lock_irqsave+0x8b/0xf0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? depot_alloc_stack+0x4c/0x1f0 ? __pfx_uprobe_dispatcher+0x10/0x10 ? __kasan_slab_alloc+0x4d/0x90 handler_chain+0xdd/0x3e0 handle_swbp+0x26e/0x3d0 ? __pfx_handle_swbp+0x10/0x10 ? uprobe_pre_sstep_notifier+0x151/0x1b0 irqentry_exit_to_user_mode+0xe2/0x1b0 asm_exc_int3+0x39/0x40 RIP: 0033:0x401199 C\u00f3digo: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce RSP: 002b:00007ffdf00576a8 EFLAGS: 00000206 RAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2 RDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0 RBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20 R10: 000000000000001 R11: 0000000000000202 R12: 0000000000401040 R13: 00007ffdf0058780 R14: 00000000000000000 R15: 0000000000000000  Esta confirmaci\u00f3n hace que la longitud m\u00e1xima del b\u00fafer sea menor que el tama\u00f1o de una p\u00e1gina para evitar el acceso fuera de memoria a store_trace_args().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_uprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dcad1a204f72624796ae83359403898d10393b9c\",\"lessThan\":\"0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcad1a204f72624796ae83359403898d10393b9c\",\"lessThan\":\"9e5f93788c9dd4309e75a56860a1ac44a8e117b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcad1a204f72624796ae83359403898d10393b9c\",\"lessThan\":\"537ad4a431f6dddbf15d40d19f24bb9ee12b55cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dcad1a204f72624796ae83359403898d10393b9c\",\"lessThan\":\"373b9338c9722a368925d83bc622c596896b328e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_uprobe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.118\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.59\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-12-11T14:49:09.097229Z\",\"id\":\"CVE-2024-50067\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14\",\"versionEndExcluding\":\"6.1.118\",\"matchCriteriaId\":\"47057BC5-54AC-4904-B963-C59598383A9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.59\",\"matchCriteriaId\":\"5D15CA59-D15C-4ACD-8B03-A072DEAD2081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"E4486B12-007B-4794-9857-F07145637AA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/373b9338c9722a368925d83bc622c596896b328e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/537ad4a431f6dddbf15d40d19f24bb9ee12b55cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e5f93788c9dd4309e75a56860a1ac44a8e117b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:08:28+00:00",
      "cve": "CVE-2024-50067",
      "id": "CVE-2024-50067",
      "initial_release_date": "2024-10-28T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: uprobe: avoid out-of-bounds memory access of fetching args",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50067.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:25:03.914Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50067\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:49:09.097229Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:49:10.716Z\"}}], \"cna\": {\"title\": \"uprobe: avoid out-of-bounds memory access of fetching args\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The overflow is driven by a uprobe firing on a locally executing process, whose registers and user-space string data supply the oversized fetch arguments. No network or physical vector is involved; the attacker needs local code execution.\\nAC:L - The traced process fully controls both the length and content of the fetched strings, so exceeding PAGE_SIZE is deterministic and repeatable \\u2014 a single 4095-byte string already overflows, and the reporter supplies a trivial reproducer.\\nPR:L - The out-of-bounds write is performed on behalf of the ordinary unprivileged process that hits the uprobe, using data it fully controls; the probe configuration is an environmental precondition of routine production tracing, not a privilege the attacker exercises. Some deployments also grant tracefs write access to a non-root tracing group.\\nUI:N - The attacker triggers the bug by running the instrumented binary itself with long string arguments; no victim action is required as part of the attack.\\nS:U - The corruption stays within the kernel\u0027s own security authority \\u2014 standard local privilege escalation, with no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The perf path memcpy\u0027s up to ~4 KB beyond the per-CPU page into trace records, disclosing adjacent kernel memory, and the controlled OOB write is readily leveraged into an arbitrary-read primitive by corrupting neighboring kernel objects.\\nI:H - This is an out-of-bounds write with attacker-chosen length and fully attacker-chosen bytes past a page-sized buffer, corrupting whatever adjacent buddy page holds (slab objects, page tables, stacks) \\u2014 a direct path to control-flow hijack and privilege escalation.\\nA:H - Smashing adjacent kernel pages with arbitrary user data reliably produces oopses and panics, as demonstrated by the KASAN splat in the fix commit, and the attacker can repeat it at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dcad1a204f72624796ae83359403898d10393b9c\", \"lessThan\": \"0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcad1a204f72624796ae83359403898d10393b9c\", \"lessThan\": \"9e5f93788c9dd4309e75a56860a1ac44a8e117b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcad1a204f72624796ae83359403898d10393b9c\", \"lessThan\": \"537ad4a431f6dddbf15d40d19f24bb9ee12b55cb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcad1a204f72624796ae83359403898d10393b9c\", \"lessThan\": \"373b9338c9722a368925d83bc622c596896b328e\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_uprobe.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.118\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_uprobe.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0dc3ad9ad2188da7f090b3dbe4d2fcd9ae8ae64f\"}, {\"url\": \"https://git.kernel.org/stable/c/9e5f93788c9dd4309e75a56860a1ac44a8e117b9\"}, {\"url\": \"https://git.kernel.org/stable/c/537ad4a431f6dddbf15d40d19f24bb9ee12b55cb\"}, {\"url\": \"https://git.kernel.org/stable/c/373b9338c9722a368925d83bc622c596896b328e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nuprobe: avoid out-of-bounds memory access of fetching args\\n\\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\\nbuffer to avoid non-atomic context problem.\\n\\nSometimes user-space strings, arrays can be very large, but the size of\\npercpu buffer is only page size. And store_trace_args() won\u0027t check\\nwhether these data exceeds a single page or not, caused out-of-bounds\\nmemory access.\\n\\nIt could be reproduced by following steps:\\n1. build kernel with CONFIG_KASAN enabled\\n2. save follow program as test.c\\n\\n```\\n\\\\#include \u003cstdio.h\u003e\\n\\\\#include \u003cstdlib.h\u003e\\n\\\\#include \u003cstring.h\u003e\\n\\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\\n// will return 0, cause __get_data_size() return shorter size, and\\n// store_trace_args() will not trigger out-of-bounds access.\\n// So make string length less than 4096.\\n\\\\#define STRLEN 4093\\n\\nvoid generate_string(char *str, int n)\\n{\\n    int i;\\n    for (i = 0; i \u003c n; ++i)\\n    {\\n        char c = i % 26 + \u0027a\u0027;\\n        str[i] = c;\\n    }\\n    str[n-1] = \u0027\\\\0\u0027;\\n}\\n\\nvoid print_string(char *str)\\n{\\n    printf(\\\"%s\\\\n\\\", str);\\n}\\n\\nint main()\\n{\\n    char tmp[STRLEN];\\n\\n    generate_string(tmp, STRLEN);\\n    print_string(tmp);\\n\\n    return 0;\\n}\\n```\\n3. compile program\\n`gcc -o test test.c`\\n\\n4. get the offset of `print_string()`\\n```\\nobjdump -t test | grep -w print_string\\n0000000000401199 g     F .text  000000000000001b              print_string\\n```\\n\\n5. configure uprobe with offset 0x1199\\n```\\noff=0x1199\\n\\ncd /sys/kernel/debug/tracing/\\necho \\\"p /root/test:${off} arg1=+0(%di):ustring arg2=\\\\$comm arg3=+0(%di):ustring\\\"\\n \u003e uprobe_events\\necho 1 \u003e events/uprobes/enable\\necho 1 \u003e tracing_on\\n```\\n\\n6. run `test`, and kasan will report error.\\n==================================================================\\nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0\\nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18\\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x55/0x70\\n print_address_description.constprop.0+0x27/0x310\\n kasan_report+0x10f/0x120\\n ? strncpy_from_user+0x1d6/0x1f0\\n strncpy_from_user+0x1d6/0x1f0\\n ? rmqueue.constprop.0+0x70d/0x2ad0\\n process_fetch_insn+0xb26/0x1470\\n ? __pfx_process_fetch_insn+0x10/0x10\\n ? _raw_spin_lock+0x85/0xe0\\n ? __pfx__raw_spin_lock+0x10/0x10\\n ? __pte_offset_map+0x1f/0x2d0\\n ? unwind_next_frame+0xc5f/0x1f80\\n ? arch_stack_walk+0x68/0xf0\\n ? is_bpf_text_address+0x23/0x30\\n ? kernel_text_address.part.0+0xbb/0xd0\\n ? __kernel_text_address+0x66/0xb0\\n ? unwind_get_return_address+0x5e/0xa0\\n ? __pfx_stack_trace_consume_entry+0x10/0x10\\n ? arch_stack_walk+0xa2/0xf0\\n ? _raw_spin_lock_irqsave+0x8b/0xf0\\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n ? depot_alloc_stack+0x4c/0x1f0\\n ? _raw_spin_unlock_irqrestore+0xe/0x30\\n ? stack_depot_save_flags+0x35d/0x4f0\\n ? kasan_save_stack+0x34/0x50\\n ? kasan_save_stack+0x24/0x50\\n ? mutex_lock+0x91/0xe0\\n ? __pfx_mutex_lock+0x10/0x10\\n prepare_uprobe_buffer.part.0+0x2cd/0x500\\n uprobe_dispatcher+0x2c3/0x6a0\\n ? __pfx_uprobe_dispatcher+0x10/0x10\\n ? __kasan_slab_alloc+0x4d/0x90\\n handler_chain+0xdd/0x3e0\\n handle_swbp+0x26e/0x3d0\\n ? __pfx_handle_swbp+0x10/0x10\\n ? uprobe_pre_sstep_notifier+0x151/0x1b0\\n irqentry_exit_to_user_mode+0xe2/0x1b0\\n asm_exc_int3+0x39/0x40\\nRIP: 0033:0x401199\\nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce\\nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206\\nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2\\nRDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0\\nRBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20\\nR10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040\\nR13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000\\n \u003c/TASK\u003e\\n\\nThis commit enforces the buffer\u0027s maxlen less than a page-size to avoid\\nstore_trace_args() out-of-memory access.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.118\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:41:22.544Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50067\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:41:22.544Z\", \"dateReserved\": \"2024-10-21T19:36:19.939Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-28T00:57:05.734Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.