Linux Kernel
CVE-2024-38576
HIGH
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack surface via kernel diagnostic path; AC:H because abnormal jiffies condition is environmental and not attacker-controlled; PR:L since a local shell session is required.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rcu: Fix buffer overflow in print_cpu_stall_info()
The rcuc-starvation output from print_cpu_stall_info() might overflow the buffer if there is a huge difference in jiffies difference. The situation might seem improbable, but computers sometimes get very confused about time, which can result in full-sized integers, and, in this case, buffer overflow.
Also, the unsigned jiffies difference is printed using %ld, which is normally for signed integers. This is intentional for debugging purposes, but it is not obvious from the code.
This commit therefore changes sprintf() to snprintf() and adds a clarifying comment about intention of %ld format.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
AnalysisAI
Buffer overflow in the Linux kernel's RCU subsystem diagnostic function print_cpu_stall_info() allows a local low-privileged attacker - under high-complexity timing conditions - to potentially corrupt kernel memory with high impact across confidentiality, integrity, and availability. Discovered by Linux Verification Center (linuxtesting.org) via static analysis (SVACE), this flaw is a code-correctness defect rather than an actively weaponized vulnerability: EPSS sits at 0.25% (16th percentile), it is absent from CISA KEV, and no public exploit code has been identified. Vendor patches have been applied across multiple kernel stable branches.
Technical ContextAI
The vulnerability is rooted in the RCU (Read-Copy-Update) synchronization subsystem's CPU stall reporting path, specifically in print_cpu_stall_info(). CWE-120 (Classic Buffer Overflow - unbounded copy into a fixed-size destination) describes the root cause: a sprintf() call writes rcuc-starvation diagnostic output into a statically sized buffer without length checking. When the system's jiffies counter difference (the kernel's monotonic tick counter, measured in timer interrupts) becomes abnormally large - due to clock confusion, NTP corrections, virtualization clock skew, or hardware timer anomalies - the formatted output can overflow the buffer boundary. A secondary issue is that the unsigned jiffies difference was printed with the %ld signed format specifier, which, while intentional for debugging readability, is technically undefined behavior and non-obvious. The fix replaces sprintf() with snprintf() (enforcing a bounded write) and adds a clarifying comment. Affected CPEs are expressed as the wildcard cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, indicating broad kernel version coverage patched across five separate stable-tree commits.
RemediationAI
The primary remediation is to apply kernel updates that incorporate the five upstream stable-tree patch commits referenced above. Distribution vendors including Red Hat, Ubuntu, Debian, and SUSE will backport these fixes into their kernel packages; users should apply the latest available kernel update from their distribution's security channel. Exact patched version numbers are not independently confirmed from the available NVD data - consult your distribution's security advisory for the precise fixed package version. As a compensating control where immediate patching is not possible, restrict local shell access by minimizing the number of unprivileged user accounts on affected systems, as exploitation requires at minimum low-privilege local access (PR:L). This does not eliminate the underlying flaw but reduces the attack surface. Note that the triggering condition (abnormal jiffies difference) is environmental and not directly injectable by an attacker in typical deployments, further limiting urgency.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today