CVE-2024-38577: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
In the Linux kernel, the following vulnerability has been resolved:
rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow
There is a possibility of buffer overflow in showrcutaskstracegpkthread() if counters, passed to sprintf() are huge. Counter numbers, needed for this are unrealistically high, but buffer overflow is still possible.
Use snprintf() with buffer size instead of sprintf().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Modify show_rcu_tasks_trace_gp_kthread() in the rcu-tasks code to replace sprintf() with snprintf() and pass the destination buffer size, preventing buffer overflow when counters are huge.
Linux kernel (rcu-tasks) show_rcu_tasks_trace_gp_kthread() output formatting = Use snprintf() with buffer size instead of sprintf()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38577?
CVE-2024-38577 has been assigned a high severity due to the potential for a buffer overflow in the Linux kernel.
How do I fix CVE-2024-38577?
To fix CVE-2024-38577, update the Linux kernel to versions 5.10.226-1, 6.1.123-1, or newer.
What versions of the Linux kernel are affected by CVE-2024-38577?
CVE-2024-38577 affects Linux kernel versions between 5.8 and 6.1.93, as well as several versions up to 6.9.3.
Can CVE-2024-38577 lead to system compromise?
Yes, CVE-2024-38577 can potentially lead to system compromise due to the buffer overflow vulnerability.
Is CVE-2024-38577 present in Debian's Linux package?
Yes, CVE-2024-38577 affects Debian's Linux packages prior to version 5.10.226-1.