linux-cve-announce - CVE-2024-57930: tracing: Have process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025012143-CVE-2024-57930-55c0@gregkh>
Date: Tue, 21 Jan 2025 13:01:44 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-57930: tracing: Have process_string() also allow arrays

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Have process_string() also allow arrays

In order to catch a common bug where a TRACE_EVENT() TP_fast_assign()
assigns an address of an allocated string to the ring buffer and then
references it in TP_printk(), which can be executed hours later when the
string is free, the function test_event_printk() runs on all events as
they are registered to make sure there's no unwanted dereferencing.

It calls process_string() to handle cases in TP_printk() format that has
"%s". It returns whether or not the string is safe. But it can have some
false positives.

For instance, xe_bo_move() has:

 TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s",
            __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size,
            xe_mem_type_to_name[__entry->old_placement],
            xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))

Where the "%s" references into xe_mem_type_to_name[]. This is an array of
pointers that should be safe for the event to access. Instead of flagging
this as a bad reference, if a reference points to an array, where the
record field is the index, consider it safe.

The Linux kernel CVE team has assigned CVE-2024-57930 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.122 with commit f3ff759ec636b4094b8eb2c3801e4e6c97a6b712 and fixed in 6.1.124 with commit 631b1e09e213c86d5a4ce23d45c81af473bb0ac7
	Issue introduced in 6.6.68 with commit 2f6ad0b613cd45cca48e6eb04f65351db018afb0 and fixed in 6.6.70 with commit a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b
	Issue introduced in 6.12.7 with commit 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64 and fixed in 6.12.9 with commit 92bd18c74624e5eb9f96e70076aa46293f4b626f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-57930
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace_events.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3bcdc9039a6e9e6e47ed689a37b8d57894a3c571
	https://git.kernel.org/stable/c/631b1e09e213c86d5a4ce23d45c81af473bb0ac7
	https://git.kernel.org/stable/c/a64e5295ebc4afdefe69cdf16cc286a60ff8ba4b
	https://git.kernel.org/stable/c/92bd18c74624e5eb9f96e70076aa46293f4b626f
	https://git.kernel.org/stable/c/afc6717628f959941d7b33728570568b4af1c4b8