CVE-2024-50074: parport: Proper fix for array out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved:
parport: Proper fix for array out-of-bounds access
The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit.
Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Replace snprintf() with scnprintf() in the parport code to ensure the returned length reflects the actually output letters and to properly address the potential array out-of-bounds access described (since snprintf() returns the would-be-printed size).
Linux kernel parport Use scnprintf() instead of snprintf() = scnprintf()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50074?
The severity of CVE-2024-50074 is classified as medium due to potential impacts on system stability.
How do I fix CVE-2024-50074?
To fix CVE-2024-50074, upgrade to the latest version of the Linux kernel that includes the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2024-50074?
CVE-2024-50074 affects Linux kernel versions from 5.10.224 to 5.10.228, 5.11 to 5.15.169, 5.16 to 6.1.114, 6.2 to 6.6.58, 6.7 to 6.11.5, and various release candidates.
What are the potential impacts of CVE-2024-50074?
The potential impacts of CVE-2024-50074 include array out-of-bounds accesses that can lead to information disclosure or system crashes.
Is there a workaround for CVE-2024-50074?
There is no specific workaround recommended for CVE-2024-50074; the best mitigation is to apply the kernel update.