CVE-2024-50067

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

uprobe: avoid out-of-bounds memory access of fetching args

Uprobe needs to fetch args into a percpu buffer, and then copy to ring

buffer to avoid non-atomic context problem.

Sometimes user-space strings, arrays can be very large, but the size of

percpu buffer is only page size. And store_trace_args() won't check

whether these data exceeds a single page or not, caused out-of-bounds

memory access.

It could be reproduced by following steps:

1. build kernel with CONFIG_KASAN enabled

2. save follow program as test.c

```

\#include <stdio.h>

\#include <stdlib.h>

\#include <string.h>

// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()

// will return 0, cause __get_data_size() return shorter size, and

// store_trace_args() will not trigger out-of-bounds access.

// So make string length less than 4096.

\#define STRLEN 4093

void generate_string(char *str, int n)

{

int i;

for (i = 0; i < n; ++i)

Remediation

Check the references section for vendor advisories and patches from debian. Update debian_linux to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References