CVE-2024-42301

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dev/parport: fix the array out-of-bounds risk

Fixed array out-of-bounds issues caused by sprintf

by replacing it with snprintf for safer data copying,

ensuring the destination buffer is not overflowed.

Below is the stack trace I encountered during the actual issue:

[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:

Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]

[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:

QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2

[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp

[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun

PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024

[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:

[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0

[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20

[ 66.575469s]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References