CVE-2024-50131 (GCVE-0-2024-50131)
Vulnerability from cvelistv5
Published
2024-11-05 17:10
Modified
2026-08-05 11:41
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it.
References
Impacted products
Vendor Product Version
Linux Linux Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
Version: dec65d79fd269d05427c8167090bfc9c3d0b56c4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:25:51.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:00:17.716Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_probe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e3231b352725ff4a3a0095e6035af674f2d8725",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "02874ca52df2ca2423ba6122039315ed61c25972",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "b86b0d6eea204116e4185acc35041ca4ff11a642",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "f4ed40d1c669bba1a54407d8182acdc405683f29",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "a14a075a14af8d622c576145455702591bdde09d",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "5fd942598ddeed9a212d1ff41f9f5b47bcc990a7",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            },
            {
              "lessThan": "0b6e2e22cb23105fcb171ab92f0f7516c69c8471",
              "status": "affected",
              "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_probe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.229",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.170",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.115",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Consider the NULL character when validating the event length\n\nstrlen() returns a string length excluding the null byte. If the string\nlength equals to the maximum buffer length, the buffer will have no\nspace for the NULL terminating character.\n\nThis commit checks this condition and returns failure for it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is a local write to the tracefs `dynamic_events`/`kprobe_events`/`uprobe_events` files via `trace_parse_run_command()`; there is no remote or network-facing consumer of `traceprobe_parse_event_name()`.\nAC:L - Triggering is fully deterministic \u2014 a single write containing an event name of exactly 64 characters passes the off-by-one check every time, with no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:L - No `capable()` or CAP_SYS_ADMIN check exists on the write path; access depends solely on tracefs file permissions, and real deployments (Android/Perfetto, perf and CI hosts) mount tracefs with `gid=` to delegate dynamic-event creation to an unprivileged non-root group.\nUI:N - The attacker performs the write themselves; no victim action, mount, or file open by another user is needed.\nS:U - The flawed validation and its consequences are entirely within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The name fills the 64-byte caller buffer with no NUL terminator, so subsequent string handling reads past the end of a kernel stack buffer and that adjacent stack content becomes part of an event name readable through tracefs, yielding unbounded kernel memory disclosure.\nI:L - The over-length name corrupts the resulting event identity (silently truncated in the eprobe path where the `strscpy()` `-E2BIG` return is ignored), allowing limited modification of kernel tracing state such as name collision or shadowing, but no out-of-bounds write or control-flow primitive exists on any in-tree path.\nA:H - An unterminated string in a fixed stack buffer leads to out-of-bounds reads during later `strlen()`/`kstrdup()` handling, which can fault and oops the kernel, and any kernel crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:56.319Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e3231b352725ff4a3a0095e6035af674f2d8725"
        },
        {
          "url": "https://git.kernel.org/stable/c/02874ca52df2ca2423ba6122039315ed61c25972"
        },
        {
          "url": "https://git.kernel.org/stable/c/b86b0d6eea204116e4185acc35041ca4ff11a642"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4ed40d1c669bba1a54407d8182acdc405683f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/a14a075a14af8d622c576145455702591bdde09d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd942598ddeed9a212d1ff41f9f5b47bcc990a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b6e2e22cb23105fcb171ab92f0f7516c69c8471"
        }
      ],
      "title": "tracing: Consider the NULL character when validating the event length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50131",
    "datePublished": "2024-11-05T17:10:56.981Z",
    "dateReserved": "2024-10-21T19:36:19.955Z",
    "dateUpdated": "2026-08-05T11:41:56.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.