CVE-2024-57930 tracing: Have process_string() also allow arrays
A false positive in kernel tracing validation could incorrectly flag safe array references, potentially causing unnecessary warnings or instability in tracing subsystems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57930?
CVE-2024-57930 is a medium-severity vulnerability in Linux kernel, published on 21 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have process_string() also allow arrays
In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing.
It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives.
For instance, xe_bo_move() has:
TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))
Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.
Which versions are affected by CVE-2024-57930?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-57930?
Apply the vendor's patch.
Is CVE-2024-57930 being exploited?
There is no known exploitation of CVE-2024-57930 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-57930, DEBIAN-CVE-2024-57930, GHSA-j6wf-6qh3-cm45, UBUNTU-CVE-2024-57930.