CVE-2024-38577

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38577", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.926Z", "datePublished": "2024-06-19T13:37:35.797Z", "dateUpdated": "2026-08-05T11:32:54.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:54.659Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow\n\nThere is a possibility of buffer overflow in\nshow_rcu_tasks_trace_gp_kthread() if counters, passed\nto sprintf() are huge. Counter numbers, needed for this\nare unrealistically high, but buffer overflow is still\npossible.\n\nUse snprintf() with buffer size instead of sprintf().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is an RCU diagnostic dump routine reached only from in-kernel debug paths (PROVE_RCU stall check, rcutorture forward-progress check, sysrq-y) with no remote or network-facing entry point. The most severe defensible vector is a local actor on the machine.\nAC:H - Overflow requires the four unsigned long counters to render to \u226564 decimal digits, i.e. three monotonic heavy-reader counters near 10^18 simultaneously, which no attacker can drive within any feasible uptime; it additionally requires non-default builds/boot options (CONFIG_TASKS_TRACE_RCU_READ_MB plus CONFIG_PROVE_RCU, rcutorture, or rcutree.sysrq_rcu=1). These are conditions entirely outside the attacker's control.\nPR:L - No capability check guards the counter-incrementing paths, so an unprivileged local user's workload is the lowest-privileged plausible actor; scoring the higher-severity option, PR:L rather than PR:H is used even though the actual dump trigger (sysrq, rcutorture) normally implies root.\nUI:N - Emission of the RCU kthread dump happens from kernel diagnostic paths without any victim action; no user must open a file, mount a filesystem, or interact in any way.\nS:U - The stack overflow corrupts the kernel stack of the thread executing the dump, staying entirely within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The defect is an out-of-bounds stack write that can clobber the canary, saved registers, and return address; per kernel scoring guidance such memory corruption is treated as leverageable toward disclosure of kernel memory, even though the overflowing bytes themselves are uncontrolled ASCII digits and there is no direct read primitive.\nI:H - This is a classic out-of-bounds stack write of up to 23 bytes past a 64-byte buffer, overwriting adjacent frame state including the saved return address, which is scored as high integrity impact for control-flow corruption.\nA:H - Smashing the stack frame triggers __stack_chk_fail (panic) on stack-protector builds and a fatal fault on a garbage return address otherwise, i.e. a kernel crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/rcu/tasks.h"], "versions": [{"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "17c43211d45f13d1badea3942b76bf16bcc49281", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "af7b560c88fb420099e29890aa682b8a3efc8784", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "08186d0c5fb64a1cc4b43e009314ee6b173ed222", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "32d988f48ed287e676a29a15ac30701c35849aec", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "6593d857ce5b5b802fb73d8091ac9c84b92c1697", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "1a240e138071b25944ded0f5b3e357aa99fabcb7", "status": "affected", "versionType": "git"}, {"version": "edf3775f0ad66879796f594983163f672c4bf1a2", "lessThan": "cc5645fddb0ce28492b15520306d092730dffa48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/rcu/tasks.h"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.226"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/17c43211d45f13d1badea3942b76bf16bcc49281"}, {"url": "https://git.kernel.org/stable/c/af7b560c88fb420099e29890aa682b8a3efc8784"}, {"url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222"}, {"url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec"}, {"url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697"}, {"url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7"}, {"url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48"}], "title": "rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:55:49.034Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:14:09.560635Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:55.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.688Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:14:09.560635Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:26.912Z"}}], "cna": {"title": "rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "edf3775f0ad6", "lessThan": "17c43211d45f", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "af7b560c88fb", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "08186d0c5fb6", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "32d988f48ed2", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "6593d857ce5b", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "1a240e138071", "versionType": "git"}, {"status": "affected", "version": "edf3775f0ad6", "lessThan": "cc5645fddb0c", "versionType": "git"}], "programFiles": ["kernel/rcu/tasks.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.226", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.167", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/rcu/tasks.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/17c43211d45f13d1badea3942b76bf16bcc49281"}, {"url": "https://git.kernel.org/stable/c/af7b560c88fb420099e29890aa682b8a3efc8784"}, {"url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222"}, {"url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec"}, {"url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697"}, {"url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7"}, {"url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow\n\nThere is a possibility of buffer overflow in\nshow_rcu_tasks_trace_gp_kthread() if counters, passed\nto sprintf() are huge. Counter numbers, needed for this\nare unrealistically high, but buffer overflow is still\npossible.\n\nUse snprintf() with buffer size instead of sprintf().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:30:14.553Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38577", "state": "PUBLISHED", "dateUpdated": "2024-11-05T09:30:14.553Z", "dateReserved": "2024-06-18T19:36:34.926Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T13:37:35.797Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/rcu/tasks.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "17c43211d45f13d1badea3942b76bf16bcc49281", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "af7b560c88fb420099e29890aa682b8a3efc8784", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "08186d0c5fb64a1cc4b43e009314ee6b173ed222", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "32d988f48ed287e676a29a15ac30701c35849aec", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "6593d857ce5b5b802fb73d8091ac9c84b92c1697", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "1a240e138071b25944ded0f5b3e357aa99fabcb7", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}, {"lessThan": "cc5645fddb0ce28492b15520306d092730dffa48", "status": "affected", "version": "edf3775f0ad66879796f594983163f672c4bf1a2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/rcu/tasks.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.226", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.167", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.12", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02AE66CA-F52E-468E-9D49-2E7B8C184CF2", "versionEndExcluding": "5.10.226", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "043405A4-25FE-45D4-A7BB-2A0C3B7D17C1", "versionEndExcluding": "5.15.167", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEFB78EE-F990-4197-BF1C-156760A55667", "versionEndExcluding": "6.1.93", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow\n\nThere is a possibility of buffer overflow in\nshow_rcu_tasks_trace_gp_kthread() if counters, passed\nto sprintf() are huge. Counter numbers, needed for this\nare unrealistically high, but buffer overflow is still\npossible.\n\nUse snprintf() with buffer size instead of sprintf().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rcu-tasks: Corrige show_rcu_tasks_trace_gp_kthread desbordamiento del b\u00fafer. Existe la posibilidad de que se produzca un desbordamiento del b\u00fafer en show_rcu_tasks_trace_gp_kthread() si los contadores pasados a sprintf() son enormes. Los n\u00fameros de contador necesarios para esto son excesivamente altos, pero a\u00fan es posible un desbordamiento del b\u00fafer. Utilice snprintf() con tama\u00f1o de b\u00fafer en lugar de sprintf(). Encontrado por el Centro de verificaci\u00f3n de Linux (linuxtesting.org) con SVACE."}], "id": "CVE-2024-38577", "lastModified": "2026-08-04T11:18:46.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38577", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:14:09.560635Z", "version": "2.0.3"}}]}, "published": "2024-06-19T14:15:17.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/17c43211d45f13d1badea3942b76bf16bcc49281"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af7b560c88fb420099e29890aa682b8a3efc8784"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/08186d0c5fb64a1cc4b43e009314ee6b173ed222"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a240e138071b25944ded0f5b3e357aa99fabcb7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32d988f48ed287e676a29a15ac30701c35849aec"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6593d857ce5b5b802fb73d8091ac9c84b92c1697"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc5645fddb0ce28492b15520306d092730dffa48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow", "id": "2293416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293416"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow\nThere is a possibility of buffer overflow in\nshow_rcu_tasks_trace_gp_kthread() if counters, passed\nto sprintf() are huge. Counter numbers, needed for this\nare unrealistically high, but buffer overflow is still\npossible.\nUse snprintf() with buffer size instead of sprintf().\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "A potential buffer overflow was found in show_rcu_tasks_trace_gp_kthread in the Linux kernel. This issue may lead to a crash."], "name": "CVE-2024-38577", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38577\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38577\nhttps://lore.kernel.org/linux-cve-announce/2024061947-CVE-2024-38577-7369@gregkh/T"], "statement": "No Red Hat products are affected by this vulnerability.", "threat_severity": "Low"}

{}