FKIE_CVE-2024-57930

Vulnerability from fkie_nvd - Published: 2025-01-21 12:15 - Updated: 2026-06-17 08:14
Severity
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing. It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives. For instance, xe_bo_move() has: TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8Patch
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 6.13
linux linux_kernel 6.13
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bcdc9039a6e9e6e47ed689a37b8d57894a3c571",
              "status": "affected",
              "version": "85d7635d54d75a2589f28583dc17feedc3aa4ad6",
              "versionType": "git"
            },
            {
              "lessThan": "631b1e09e213c86d5a4ce23d45c81af473bb0ac7",
              "status": "affected",
              "version": "f3ff759ec636b4094b8eb2c3801e4e6c97a6b712",
              "versionType": "git"
            },
            {
              "lessThan": "a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b",
              "status": "affected",
              "version": "2f6ad0b613cd45cca48e6eb04f65351db018afb0",
              "versionType": "git"
            },
            {
              "lessThan": "92bd18c74624e5eb9f96e70076aa46293f4b626f",
              "status": "affected",
              "version": "683eccacc02d2eb25d1c34b8fb0363fcc7e08f64",
              "versionType": "git"
            },
            {
              "lessThan": "afc6717628f959941d7b33728570568b4af1c4b8",
              "status": "affected",
              "version": "65a25d9f7ac02e0cf361356e834d1c71d36acca9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.124",
              "status": "affected",
              "version": "6.1.122",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.70",
              "status": "affected",
              "version": "6.6.68",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.9",
              "status": "affected",
              "version": "6.12.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EDA3ED4-4116-4259-BEE5-ABEFBBB0E710",
              "versionEndExcluding": "6.1.124",
              "versionStartIncluding": "6.1.122",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97FA6055-53B4-4B50-8BC9-C6F6FEA0E249",
              "versionEndExcluding": "6.6.70",
              "versionStartIncluding": "6.6.68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "12907B6F-F263-4F75-8011-F58AC6DD3998",
              "versionEndExcluding": "6.12.9",
              "versionStartIncluding": "6.12.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Have process_string() also allow arrays\n\nIn order to catch a common bug where a TRACE_EVENT() TP_fast_assign()\nassigns an address of an allocated string to the ring buffer and then\nreferences it in TP_printk(), which can be executed hours later when the\nstring is free, the function test_event_printk() runs on all events as\nthey are registered to make sure there\u0027s no unwanted dereferencing.\n\nIt calls process_string() to handle cases in TP_printk() format that has\n\"%s\". It returns whether or not the string is safe. But it can have some\nfalse positives.\n\nFor instance, xe_bo_move() has:\n\n TP_printk(\"move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s\",\n            __entry-\u003emove_lacks_source ? \"yes\" : \"no\", __entry-\u003ebo, __entry-\u003esize,\n            xe_mem_type_to_name[__entry-\u003eold_placement],\n            xe_mem_type_to_name[__entry-\u003enew_placement], __get_str(device_id))\n\nWhere the \"%s\" references into xe_mem_type_to_name[]. This is an array of\npointers that should be safe for the event to access. Instead of flagging\nthis as a bad reference, if a reference points to an array, where the\nrecord field is the index, consider it safe."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Hacer que process_string() tambi\u00e9n permita matrices Para detectar un error com\u00fan en el que un TP_fast_assign() de TRACE_EVENT() asigna una direcci\u00f3n de una cadena asignada al b\u00fafer de anillo y luego la referencia en TP_printk(), que se puede ejecutar horas despu\u00e9s cuando la cadena est\u00e1 libre, la funci\u00f3n test_event_printk() se ejecuta en todos los eventos a medida que se registran para asegurarse de que no haya desreferenciaciones no deseadas. Llama a process_string() para gestionar los casos en formato TP_printk() que tienen \"%s\". Devuelve si la cadena es segura o no. Pero puede tener algunos falsos positivos. Por ejemplo, xe_bo_move() tiene: TP_printk(\"move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s\", __entry-\u0026gt;move_lacks_source ? \"yes\" : \"no\", __entry-\u0026gt;bo, __entry-\u0026gt;size, xe_mem_type_to_name[__entry-\u0026gt;old_placement], xe_mem_type_to_name[__entry-\u0026gt;new_placement], __get_str(device_id)) Where the \"%s\" Donde \"%s\" hace referencia a xe_mem_type_to_name[]. Esta es una matriz de punteros a los que el evento deber\u00eda poder acceder de forma segura. En lugar de marcar esto como una referencia incorrecta, si una referencia apunta a una matriz, donde el campo de registro es el \u00edndice, consid\u00e9rela segura."
    }
  ],
  "id": "CVE-2024-57930",
  "lastModified": "2026-06-17T08:14:15.550",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-01-21T12:15:26.600",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.