CVE-2024-50074 (GCVE-0-2024-50074)
Vulnerability from cvelistv5
Published
2024-10-29 00:50
Modified
2026-08-05 11:41
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.
References
Impacted products
Vendor Product Version
Linux Linux Version: 166a0bddcc27de41fe13f861c8348e8e53e988c8
Version: 47b3dce100778001cd76f7e9188944b5cb27a76d
Version: a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0
Version: c719b393374d3763e64900ee19aaed767d5a08d6
Version: 7f4da759092a1a6ce35fb085182d02de8cc4cc84
Version: b579ea3516c371ecf59d073772bc45dfd28c8a0e
Version: ab11dac93d2d568d151b1918d7b84c2d02bacbd5
Version: ab11dac93d2d568d151b1918d7b84c2d02bacbd5
Version: 7789a1d6792af410aa9b39a1eb237ed24fa2170a
Version: 4.19.320   ≤
Version: 5.4.282   ≤
Version: 5.10.224   ≤
Version: 5.15.165   ≤
Version: 6.1.103   ≤
Version: 6.6.44   ≤
Version: 6.10.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:25:09.766Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/parport/procfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8aadef73ba3b325704ed5cfc4696a25c350182cf",
              "status": "affected",
              "version": "166a0bddcc27de41fe13f861c8348e8e53e988c8",
              "versionType": "git"
            },
            {
              "lessThan": "b0641e53e6cb937487b6cfb15772374f0ba149b3",
              "status": "affected",
              "version": "47b3dce100778001cd76f7e9188944b5cb27a76d",
              "versionType": "git"
            },
            {
              "lessThan": "1826b6d69bbb7f9ae8711827facbb2ad7f8d0aaa",
              "status": "affected",
              "version": "a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0",
              "versionType": "git"
            },
            {
              "lessThan": "440311903231c6e6c9bcf8acb6a2885a422e00bc",
              "status": "affected",
              "version": "c719b393374d3763e64900ee19aaed767d5a08d6",
              "versionType": "git"
            },
            {
              "lessThan": "fca048f222ce9dcbde5708ba2bf81d85a4a27952",
              "status": "affected",
              "version": "7f4da759092a1a6ce35fb085182d02de8cc4cc84",
              "versionType": "git"
            },
            {
              "lessThan": "66029078fee00646e2e9dbb8f41ff7819f8e7569",
              "status": "affected",
              "version": "b579ea3516c371ecf59d073772bc45dfd28c8a0e",
              "versionType": "git"
            },
            {
              "lessThan": "2a8b26a09c8e3ea03da1ef3cd0ef6b96e559fba6",
              "status": "affected",
              "version": "ab11dac93d2d568d151b1918d7b84c2d02bacbd5",
              "versionType": "git"
            },
            {
              "lessThan": "02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9",
              "status": "affected",
              "version": "ab11dac93d2d568d151b1918d7b84c2d02bacbd5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7789a1d6792af410aa9b39a1eb237ed24fa2170a",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.323",
              "status": "affected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.285",
              "status": "affected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.228",
              "status": "affected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.169",
              "status": "affected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.114",
              "status": "affected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.58",
              "status": "affected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/parport/procfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.228",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "4.19.320",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.4.282",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.228",
                  "versionStartIncluding": "5.10.224",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.169",
                  "versionStartIncluding": "5.15.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.114",
                  "versionStartIncluding": "6.1.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.6.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Proper fix for array out-of-bounds access\n\nThe recent fix for array out-of-bounds accesses replaced sprintf()\ncalls blindly with snprintf().  However, since snprintf() returns the\nwould-be-printed size, not the actually output size, the length\ncalculation can still go over the given limit.\n\nUse scnprintf() instead of snprintf(), which returns the actually\noutput letters, for addressing the potential out-of-bounds access\nproperly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by a plain read() syscall on /proc/sys/dev/parport/parportN/autoprobe (and siblings), which requires local access to the system. No network or physical interaction with the machine is needed by the attacker at exploit time on a host that already has a parallel-port peripheral attached.\nAC:L - Once a parport peripheral with a device ID exceeding the 256-byte stack buffer is present \u2014 a common configuration, since real IEEE 1284 device IDs frequently run 300+ bytes and can be up to 1024 \u2014 the attacker triggers the overflow deterministically and repeatedly by simply reading the file with a large count. There is no race, no memory-layout guessing, and no per-attempt effort.\nPR:L - The sysctl entries are registered with .mode = 0444 and sysctl_perm() enforces nothing beyond that, so any unprivileged local account can read them. No capability, no root, and no user-namespace trickery is required.\nUI:N - The attacker performs the read themselves; no victim action, mount, or file-open by another user is needed.\nS:U - The corruption and the disclosure are confined to the kernel\u0027s own stack within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - memcpy(result, buffer, len) with len \u003e sizeof(buffer) copies hundreds of bytes of adjacent kernel stack into the sysctl output buffer, which is then copied straight to userspace \u2014 a direct kernel stack memory disclosure exposing stack canaries, saved registers, and kernel pointers usable to defeat KASLR.\nI:H - In do_autoprobe(), sizeof(buffer) - len underflows to a huge size_t once len exceeds 256, giving an unbounded write of peripheral-controlled string data past the end of a 256-byte stack buffer \u2014 overwriting saved registers and the return address, which is exploitable for control-flow hijacking.\nA:H - Stack corruption in these handlers triggers __stack_chk_fail() and a non-syncing kernel panic, as demonstrated in the original bug report\u0027s backtrace; an unprivileged user can induce it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:24.682Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8aadef73ba3b325704ed5cfc4696a25c350182cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0641e53e6cb937487b6cfb15772374f0ba149b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1826b6d69bbb7f9ae8711827facbb2ad7f8d0aaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/440311903231c6e6c9bcf8acb6a2885a422e00bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca048f222ce9dcbde5708ba2bf81d85a4a27952"
        },
        {
          "url": "https://git.kernel.org/stable/c/66029078fee00646e2e9dbb8f41ff7819f8e7569"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a8b26a09c8e3ea03da1ef3cd0ef6b96e559fba6"
        },
        {
          "url": "https://git.kernel.org/stable/c/02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9"
        }
      ],
      "title": "parport: Proper fix for array out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50074",
    "datePublished": "2024-10-29T00:50:16.263Z",
    "dateReserved": "2024-10-21T19:36:19.940Z",
    "dateUpdated": "2026-08-05T11:41:24.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.