CVE-2024-57930

Medium

In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing. It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives. For instance, xe_bo_move() has: TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.

Package Linux Kernel
Published 2025-01-21
Last modified 2025-11-03
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.1.122, 6.6.68, 6.12.7 and later are affected. Fixed in 6.1.124, 6.6.70, 6.12.9 and their respective stable series.

Affected from
≥ 6.1.122 ≥ 6.6.68 ≥ 6.12.7
Fixed in
✓ 6.1.124 6.1.x ✓ 6.6.70 6.6.x ✓ 6.12.9 6.12.x

References

6 total
Showing 5 of 6 references View all on NVD

Frequently asked questions

  • What is CVE-2024-57930?

    CVE-2024-57930 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.1.122 onward and has been patched in 6.1.124, 6.6.70 and 6.12.9. CVE-2024-57930 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2024-57930?

    CVE-2024-57930 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2024-57930?

    Yes. CVE-2024-57930 has been patched. Fixed versions include 6.1.124, 6.6.70 and 6.12.9. If you are running Linux kernel 6.1.122 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2024-57930 actively exploited?

    No. CVE-2024-57930 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST