CVE-2024-57930

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Have process_string() also allow arrays

In order to catch a common bug where a TRACE_EVENT() TP_fast_assign()

assigns an address of an allocated string to the ring buffer and then

references it in TP_printk(), which can be executed hours later when the

string is free, the function test_event_printk() runs on all events as

they are registered to make sure there's no unwanted dereferencing.

It calls process_string() to handle cases in TP_printk() format that has

"%s". It returns whether or not the string is safe. But it can have some

false positives.

For instance, xe_bo_move() has:

TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s",

__entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size,

xe_mem_type_to_name[__entry->old_placement],

xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))

Where the "%s" refe

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References