CVE-2024-50132 in Linux
Summary
by MITRE • 11/05/2024
In the Linux kernel, the following vulnerability has been resolved:
tracing/probes: Fix MAX_TRACE_ARGS limit handling
When creating a trace_probe we would set nr_args prior to truncating the arguments to MAX_TRACE_ARGS. However, we would only initialize arguments up to the limit.
This caused invalid memory access when attempting to set up probes with more than 128 fetchargs.
BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:__set_print_fmt+0x134/0x330
Resolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return an error when there are too many arguments instead of silently truncating.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2025
The vulnerability CVE-2024-50132 represents a critical memory safety issue within the Linux kernel's tracing subsystem, specifically affecting the trace probe functionality. This flaw exists in the interaction between kernel tracing mechanisms and argument handling for trace probes, where improper sequence of operations leads to memory access violations. The vulnerability manifests when attempting to configure trace probes with more than 128 arguments, creating a scenario where the kernel's memory management becomes inconsistent and potentially exploitable. The issue is categorized under CWE-125 as an out-of-bounds read condition, though it specifically impacts kernel-level memory access patterns through improper argument limit handling.
The technical implementation flaw occurs during the trace_probe creation process where the kernel first sets the nr_args parameter to indicate the total number of arguments before applying the MAX_TRACE_ARGS limit. However, the kernel only initializes memory structures for arguments up to the maximum limit of 128, creating a mismatch between the reported argument count and the actual allocated memory space. This design inconsistency results in invalid memory access patterns when the kernel attempts to process trace probes with argument counts exceeding the limit, causing a kernel NULL pointer dereference at address 0x0000000000000020. The error occurs during the __set_print_fmt function execution, indicating a fundamental breakdown in kernel memory management during trace probe setup operations.
The operational impact of this vulnerability extends beyond simple system instability, potentially allowing for privilege escalation or denial of service conditions within kernel space. When a malicious actor or legitimate process attempts to create trace probes with excessive arguments, the kernel's memory management system becomes corrupted, leading to system crashes and potential information disclosure. The vulnerability affects systems running kernel versions where the tracing subsystem is active, particularly impacting servers and systems that rely heavily on kernel tracing for monitoring and debugging operations. The specific error pattern suggests this could be exploited to gain unauthorized access to kernel memory regions, though the exact attack vectors remain limited by the nature of kernel tracing interfaces.
The resolution implemented for this vulnerability addresses the root cause by enforcing the MAX_TRACE_ARGS limit prior to argument processing, ensuring that the kernel returns an error condition rather than silently truncating arguments. This approach aligns with secure coding practices that emphasize explicit error handling over implicit behavior that can lead to memory corruption. The fix prevents the scenario where memory is allocated based on a limited capacity while the system attempts to reference a larger argument count, thereby eliminating the memory access violation. From an ATT&CK perspective, this vulnerability relates to privilege escalation techniques through kernel memory corruption, though it does not directly map to specific ATT&CK tactics as it represents a defensive mechanism failure rather than an active attack pattern. The mitigation strategy ensures that systems maintain consistent memory boundaries and prevents the kernel from entering an inconsistent state during trace probe initialization, thereby protecting against potential exploitation scenarios.