{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38577", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.926Z", "datePublished": "2024-06-19T13:37:35.797Z", "dateUpdated": "2026-08-05T11:32:54.659Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:54.659Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow\n\nThere is a possibility of buffer overflow in\nshow_rcu_tasks_trace_gp_kthread() if counters, passed\nto sprintf() are huge. Counter numbers, needed for this\nare unrealistically high, but buffer overflow is still\npossible.\n\nUse snprintf() with buffer size instead of sprintf().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is an RCU diagnostic dump routine reached only from in-kernel debug paths (PROVE_RCU stall check, rcutorture forward-progress check, sysrq-y) with no remote or network-facing entry point. The most severe defensible vector is a local actor on the machine.\nAC:H - Overflow requires the four unsigned long counters to render to ≥64 decimal digits, i.e. three monotonic heavy-reader counters near 10^18 simultaneously, which no attacker can drive within any feasible uptime; it additionally requires non-default builds/boot options (CONFIG_TASKS_TRACE_RCU_READ_MB plus CONFIG_PROVE_RCU, rcutorture, or rcutree.sysrq_rcu=1). These are conditions entirely outside the attacker's control.\nPR:L - No capability check guards the counter-incrementing paths, so an unprivileged local user's workload is the lowest-privileged plausible actor; scoring the higher-severity option, PR:L rather than PR:H is used even though the actual dump trigger (sysrq, rcutorture) normally implies root.\nUI:N - Emission of the RCU kthread dump happens from kernel diagnostic paths without any victim action; no user must open a file, mount a filesystem, or interact in any way.\nS:U - The stack overflow corrupts the kernel stack of the thread executing the dump, staying entirely within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The defect is an out-of-bounds stack write that can clobber the canary, saved registers, and return address; per kernel scoring guidance such memory corruption is treated as leverageable toward disclosure of kernel memory, even though the overflowing bytes themselves are uncontrolled ASCII digits and there is no direct read primitive.\nI:H - This is a classic out-of-bounds stack write of up to 23 bytes past a 64-byte buffer, overwriting adjacent frame state including the saved return address, which is scored as high integrity impact for control-flow corruption.\nA:H - Smashing the stack frame triggers __stack_chk_fail (panic) on stack-protector builds and a fatal fault on a garbage return address otherwise, i.e. a kernel crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/rcu/tasks.h" ], "versions": [ { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "17c43211d45f13d1badea3942b76bf16bcc49281", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "af7b560c88fb420099e29890aa682b8a3efc8784", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "08186d0c5fb64a1cc4b43e009314ee6b173ed222", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "32d988f48ed287e676a29a15ac30701c35849aec", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "6593d857ce5b5b802fb73d8091ac9c84b92c1697", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "1a240e138071b25944ded0f5b3e357aa99fabcb7", "status": "affected", "versionType": "git" }, { "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "cc5645fddb0ce28492b15520306d092730dffa48", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/rcu/tasks.h" ], "versions": [ { "version": "5.8", "status": "affected" }, { "version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.226" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.8.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.9.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/17c43211d45f13d1badea3942b76bf16bcc49281" }, { "url": "https://git.kernel.org/stable/c/af7b560c88fb420099e29890aa682b8a3efc8784" }, { "url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222" }, { "url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec" }, { "url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697" }, { "url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7" }, { "url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48" } ], "title": "rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:55:49.034Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-38577", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:14:09.560635Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:55.793Z" } } ] } }