CVE-2024-57930

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57930
In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing. It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives. For instance, xe_bo_move() has: TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571 Patch
https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7 Patch
https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626f Patch
https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b Patch
https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
History

15 Oct 2025, 13:52

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Hacer que process_string() también permita matrices Para detectar un error común en el que un TP_fast_assign() de TRACE_EVENT() asigna una dirección de una cadena asignada al búfer de anillo y luego la referencia en TP_printk(), que se puede ejecutar horas después cuando la cadena está libre, la función test_event_printk() se ejecuta en todos los eventos a medida que se registran para asegurarse de que no haya desreferenciaciones no deseadas. Llama a process_string() para gestionar los casos en formato TP_printk() que tienen "%s". Devuelve si la cadena es segura o no. Pero puede tener algunos falsos positivos. Por ejemplo, xe_bo_move() tiene: TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) Where the "%s" Donde "%s" hace referencia a xe_mem_type_to_name[]. Esta es una matriz de punteros a los que el evento debería poder acceder de forma segura. En lugar de marcar esto como una referencia incorrecta, si una referencia apunta a una matriz, donde el campo de registro es el índice, considérela segura.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571 - () https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571 - Patch
References () https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7 - () https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7 - Patch
References () https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626f - () https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626f - Patch
References () https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b - () https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b - Patch
References () https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8 - () https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8 - Patch

21 Jan 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 12:15

Updated : 2025-10-15 13:52

NVD link : CVE-2024-57930

Mitre link : CVE-2024-57930

CVE.ORG link : CVE-2024-57930

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo