What’s Vulnerable › Vulnerabilities
CVE-2024-50131: tracing: Consider the NULL character when validating the event length
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-05 · updated 2026-10-15
- Weakness: CWE-120
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it.
Affected products
- Linux kernel: from 5.1 before 5.15.170; from 5.16 before 6.1.115; from 6.2 before 6.6.59; from 6.7 before 6.11.6; 6.12-rc1, 6.12-rc2, 6.12-rc3, 6.12-rc4 — fixed in 5.15.170, 6.1.115, 6.11.6, 6.6.59
How to fix
Upgrade to a fixed version: Linux kernel 5.15.170, 6.1.115, 6.11.6, 6.6.59. Check the vendor advisory for mitigations.
References
- https://git.kernel.org/stable/c/02874ca52df2ca2423ba6122039315ed61c25972
- https://git.kernel.org/stable/c/0b6e2e22cb23105fcb171ab92f0f7516c69c8471
- https://git.kernel.org/stable/c/5e3231b352725ff4a3a0095e6035af674f2d8725
- https://git.kernel.org/stable/c/5fd942598ddeed9a212d1ff41f9f5b47bcc990a7
- https://git.kernel.org/stable/c/a14a075a14af8d622c576145455702591bdde09d
- https://git.kernel.org/stable/c/b86b0d6eea204116e4185acc35041ca4ff11a642
- https://git.kernel.org/stable/c/f4ed40d1c669bba1a54407d8182acdc405683f29
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Get alerted when CVE-2024-50131 or the next vulnerability affects your stack