{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50131", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.955Z", "datePublished": "2024-11-05T17:10:56.981Z", "dateUpdated": "2026-08-05T11:41:56.319Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:56.319Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Consider the NULL character when validating the event length\n\nstrlen() returns a string length excluding the null byte. If the string\nlength equals to the maximum buffer length, the buffer will have no\nspace for the NULL terminating character.\n\nThis commit checks this condition and returns failure for it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only entry point is a local write to the tracefs `dynamic_events`/`kprobe_events`/`uprobe_events` files via `trace_parse_run_command()`; there is no remote or network-facing consumer of `traceprobe_parse_event_name()`.\nAC:L - Triggering is fully deterministic — a single write containing an event name of exactly 64 characters passes the off-by-one check every time, with no race, timing, or memory-layout condition outside the attacker's control.\nPR:L - No `capable()` or CAP_SYS_ADMIN check exists on the write path; access depends solely on tracefs file permissions, and real deployments (Android/Perfetto, perf and CI hosts) mount tracefs with `gid=` to delegate dynamic-event creation to an unprivileged non-root group.\nUI:N - The attacker performs the write themselves; no victim action, mount, or file open by another user is needed.\nS:U - The flawed validation and its consequences are entirely within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The name fills the 64-byte caller buffer with no NUL terminator, so subsequent string handling reads past the end of a kernel stack buffer and that adjacent stack content becomes part of an event name readable through tracefs, yielding unbounded kernel memory disclosure.\nI:L - The over-length name corrupts the resulting event identity (silently truncated in the eprobe path where the `strscpy()` `-E2BIG` return is ignored), allowing limited modification of kernel tracing state such as name collision or shadowing, but no out-of-bounds write or control-flow primitive exists on any in-tree path.\nA:H - An unterminated string in a fixed stack buffer leads to out-of-bounds reads during later `strlen()`/`kstrdup()` handling, which can fault and oops the kernel, and any kernel crash is scored High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_probe.c" ], "versions": [ { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "5e3231b352725ff4a3a0095e6035af674f2d8725", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "02874ca52df2ca2423ba6122039315ed61c25972", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "b86b0d6eea204116e4185acc35041ca4ff11a642", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "f4ed40d1c669bba1a54407d8182acdc405683f29", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "a14a075a14af8d622c576145455702591bdde09d", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "5fd942598ddeed9a212d1ff41f9f5b47bcc990a7", "status": "affected", "versionType": "git" }, { "version": "dec65d79fd269d05427c8167090bfc9c3d0b56c4", "lessThan": "0b6e2e22cb23105fcb171ab92f0f7516c69c8471", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_probe.c" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.229", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.170", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.115", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.59", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.6", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.285" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.229" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.170" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.115" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.59" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.11.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5e3231b352725ff4a3a0095e6035af674f2d8725" }, { "url": "https://git.kernel.org/stable/c/02874ca52df2ca2423ba6122039315ed61c25972" }, { "url": "https://git.kernel.org/stable/c/b86b0d6eea204116e4185acc35041ca4ff11a642" }, { "url": "https://git.kernel.org/stable/c/f4ed40d1c669bba1a54407d8182acdc405683f29" }, { "url": "https://git.kernel.org/stable/c/a14a075a14af8d622c576145455702591bdde09d" }, { "url": "https://git.kernel.org/stable/c/5fd942598ddeed9a212d1ff41f9f5b47bcc990a7" }, { "url": "https://git.kernel.org/stable/c/0b6e2e22cb23105fcb171ab92f0f7516c69c8471" } ], "title": "tracing: Consider the NULL character when validating the event length", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:25:51.692Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:00:17.716Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }