https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 27 May 2026 15:24:42 +0000 https://vulnerability.circl.lu/sighting/58dd0a16-28f6-4794-a34f-21ab8414f58c/export {"uuid": "58dd0a16-28f6-4794-a34f-21ab8414f58c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-50067", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/9084", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-50067 - \"Linux kernel uprobe vulnerability: Out-of-bounds memory access of fetching args\"\", \n \"Content\": \"CVE ID : CVE-2024-50067 \nPublished : Oct. 28, 2024, 1:15 a.m. | 29\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved: \n \nuprobe: avoid out-of-bounds memory access of fetching args \n \nUprobe needs to fetch args into a percpu buffer, and then copy to ring \nbuffer to avoid non-atomic context problem. \n \nSometimes user-space strings, arrays can be very large, but the size of \npercpu buffer is only page size. And store_trace_args() won't check \nwhether these data exceeds a single page or not, caused out-of-bounds \nmemory access. \n \nIt could be reproduced by following steps: \n1. build kernel with CONFIG_KASAN enabled \n2. save follow program as test.c \n \n``` \n\\#include \n\\#include \n\\#include \n \n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen() \n// will return 0, cause __get_data_size() return shorter size, and \n// store_trace_args() will not trigger out-of-bounds access. \n// So make string length less than 4096. \n\\#define STRLEN 4093 \n \nvoid generate_string(char *str, int n) \n{ \n int i; \n for (i = 0; i < n; ++i) \n { \n char c = i % 26 + 'a'; \n str[i] = c; \n } \n str[n-1] = '\\0'; \n} \n \nvoid print_string(char *str) \n{ \n printf(\"%s\\n\", str); \n} \n \nint main() \n{ \n char tmp[STRLEN]; \n \n generate_string(tmp, STRLEN); \n print_string(tmp); \n \n return 0; \n} \n``` \n3. compile program \n`gcc -o test test.c` \n \n4. get the offset of `print_string()` \n``` \nobjdump -t test | grep -w print_string \n0000000000401199 g F .text 000000000000001b print_string \n``` \n \n5. configure uprobe with offset 0x1199 \n``` \noff=0x1199 \n \ncd /sys/kernel/debug/tracing/ \necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\" \n > uprobe_events \necho 1 > events/uprobes/enable \necho 1 > tracing_on \n``` \n \n6. run `test`, and kasan will report error. \n================================================================== \nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0 \nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18 \nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 \nCall Trace: \n \n dump_stack_lvl+0x55/0x70 \n print_address_description.constprop.0+0x27/0x310 \n kasan_report+0x10f/0x120 \n ? strncpy_from_user+0x1d6/0x1f0 \n strncpy_from_user+0x1d6/0x1f0 \n ? rmqueue.constprop.0+0x70d/0x2ad0 \n process_fetch_insn+0xb26/0x1470 \n ? __pfx_process_fetch_insn+0x10/0x10 \n ? _raw_spin_lock+0x85/0xe0 \n ? __pfx__raw_spin_lock+0x10/0x10 \n ? __pte_offset_map+0x1f/0x2d0 \n ? unwind_next_frame+0xc5f/0x1f80 \n ? arch_stack_walk+0x68/0xf0 \n ? is_bpf_text_address+0x23/0x30 \n ? kernel_text_address.part.0+0xbb/0xd0 \n ? __kernel_text_address+0x66/0xb0 \n ? unwind_get_return_address+0x5e/0xa0 \n ? __pfx_stack_trace_consume_entry+0x10/0x10 \n ? arch_stack_walk+0xa2/0xf0 \n ? _raw_spin_lock_irqsave+0x8b/0xf0 \n ? __pfx__raw_spin_lock_irqsave+0x10/0x10 \n ? depot_alloc_stack+0x4c/0x1f0 \n ? _raw_spin_unlock_irqrestore+0xe/0x30 \n ? stack_depot_save_flags+0x35d/0x4f0 \n ? kasan_save_stack+0x34/0x50 \n ? kasan_save_stack+0x24/0x50 \n ? mutex_lock+0x91/0xe0 \n ? __pfx_mutex_lock+0x10/0x10 \n prepare_uprobe_buffer.part.0+0x2cd/0x500 \n uprobe_dispatcher+0x2c3/0x6a0 \n ? __pfx_uprobe_dispatcher+0x10/0x10 \n ? __kasan_slab_alloc+0x4d/0x90 \n handler_chain+0xdd/0x3e0 \n handle_swbp+0x26e/0x3d0 \n ? __pfx_handle_swbp+0x10/0x10 \n ? uprobe_pre_sstep_notifier+0x151/0x1b0 \n irqentry_exit_to_user_mode+0xe2/0x1b0 \n asm_exc_int3+0x39/0x40 \nRIP: 0033:0x401199 \nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce \nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206 \nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 000000000000[...]", "creation_timestamp": "2024-10-28T02:46:40.000000Z"} {"uuid": "58dd0a16-28f6-4794-a34f-21ab8414f58c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-50067", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/9084", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-50067 - \"Linux kernel uprobe vulnerability: Out-of-bounds memory access of fetching args\"\", \n \"Content\": \"CVE ID : CVE-2024-50067 \nPublished : Oct. 28, 2024, 1:15 a.m. | 29\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved: \n \nuprobe: avoid out-of-bounds memory access of fetching args \n \nUprobe needs to fetch args into a percpu buffer, and then copy to ring \nbuffer to avoid non-atomic context problem. \n \nSometimes user-space strings, arrays can be very large, but the size of \npercpu buffer is only page size. And store_trace_args() won't check \nwhether these data exceeds a single page or not, caused out-of-bounds \nmemory access. \n \nIt could be reproduced by following steps: \n1. build kernel with CONFIG_KASAN enabled \n2. save follow program as test.c \n \n``` \n\\#include \n\\#include \n\\#include \n \n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen() \n// will return 0, cause __get_data_size() return shorter size, and \n// store_trace_args() will not trigger out-of-bounds access. \n// So make string length less than 4096. \n\\#define STRLEN 4093 \n \nvoid generate_string(char *str, int n) \n{ \n int i; \n for (i = 0; i < n; ++i) \n { \n char c = i % 26 + 'a'; \n str[i] = c; \n } \n str[n-1] = '\\0'; \n} \n \nvoid print_string(char *str) \n{ \n printf(\"%s\\n\", str); \n} \n \nint main() \n{ \n char tmp[STRLEN]; \n \n generate_string(tmp, STRLEN); \n print_string(tmp); \n \n return 0; \n} \n``` \n3. compile program \n`gcc -o test test.c` \n \n4. get the offset of `print_string()` \n``` \nobjdump -t test | grep -w print_string \n0000000000401199 g F .text 000000000000001b print_string \n``` \n \n5. configure uprobe with offset 0x1199 \n``` \noff=0x1199 \n \ncd /sys/kernel/debug/tracing/ \necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\" \n > uprobe_events \necho 1 > events/uprobes/enable \necho 1 > tracing_on \n``` \n \n6. run `test`, and kasan will report error. \n================================================================== \nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0 \nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18 \nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 \nCall Trace: \n \n dump_stack_lvl+0x55/0x70 \n print_address_description.constprop.0+0x27/0x310 \n kasan_report+0x10f/0x120 \n ? strncpy_from_user+0x1d6/0x1f0 \n strncpy_from_user+0x1d6/0x1f0 \n ? rmqueue.constprop.0+0x70d/0x2ad0 \n process_fetch_insn+0xb26/0x1470 \n ? __pfx_process_fetch_insn+0x10/0x10 \n ? _raw_spin_lock+0x85/0xe0 \n ? __pfx__raw_spin_lock+0x10/0x10 \n ? __pte_offset_map+0x1f/0x2d0 \n ? unwind_next_frame+0xc5f/0x1f80 \n ? arch_stack_walk+0x68/0xf0 \n ? is_bpf_text_address+0x23/0x30 \n ? kernel_text_address.part.0+0xbb/0xd0 \n ? __kernel_text_address+0x66/0xb0 \n ? unwind_get_return_address+0x5e/0xa0 \n ? __pfx_stack_trace_consume_entry+0x10/0x10 \n ? arch_stack_walk+0xa2/0xf0 \n ? _raw_spin_lock_irqsave+0x8b/0xf0 \n ? __pfx__raw_spin_lock_irqsave+0x10/0x10 \n ? depot_alloc_stack+0x4c/0x1f0 \n ? _raw_spin_unlock_irqrestore+0xe/0x30 \n ? stack_depot_save_flags+0x35d/0x4f0 \n ? kasan_save_stack+0x34/0x50 \n ? kasan_save_stack+0x24/0x50 \n ? mutex_lock+0x91/0xe0 \n ? __pfx_mutex_lock+0x10/0x10 \n prepare_uprobe_buffer.part.0+0x2cd/0x500 \n uprobe_dispatcher+0x2c3/0x6a0 \n ? __pfx_uprobe_dispatcher+0x10/0x10 \n ? __kasan_slab_alloc+0x4d/0x90 \n handler_chain+0xdd/0x3e0 \n handle_swbp+0x26e/0x3d0 \n ? __pfx_handle_swbp+0x10/0x10 \n ? uprobe_pre_sstep_notifier+0x151/0x1b0 \n irqentry_exit_to_user_mode+0xe2/0x1b0 \n asm_exc_int3+0x39/0x40 \nRIP: 0033:0x401199 \nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce \nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206 \nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 000000000000[...]", "creation_timestamp": "2024-10-28T02:46:40.000000Z"} https://vulnerability.circl.lu/sighting/58dd0a16-28f6-4794-a34f-21ab8414f58c/export Mon, 28 Oct 2024 02:46:40 +0000 https://vulnerability.circl.lu/sighting/63462484-2f8f-4830-9c2f-12c64f24ee0a/export {"uuid": "63462484-2f8f-4830-9c2f-12c64f24ee0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8", "content": "", "creation_timestamp": "2025-12-03T14:14:49.267740Z"} {"uuid": "63462484-2f8f-4830-9c2f-12c64f24ee0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8", "content": "", "creation_timestamp": "2025-12-03T14:14:49.267740Z"} https://vulnerability.circl.lu/sighting/63462484-2f8f-4830-9c2f-12c64f24ee0a/export Wed, 03 Dec 2025 14:14:49 +0000 https://vulnerability.circl.lu/sighting/1613c8cf-3a30-4e33-9ecc-1be908397c8e/export {"uuid": "1613c8cf-3a30-4e33-9ecc-1be908397c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mbynkk7rzk2z", "content": "", "creation_timestamp": "2026-01-09T13:55:34.080819Z"} {"uuid": "1613c8cf-3a30-4e33-9ecc-1be908397c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mbynkk7rzk2z", "content": "", "creation_timestamp": "2026-01-09T13:55:34.080819Z"} https://vulnerability.circl.lu/sighting/1613c8cf-3a30-4e33-9ecc-1be908397c8e/export Fri, 09 Jan 2026 13:55:34 +0000 https://vulnerability.circl.lu/sighting/6d2c03b2-98a4-4952-a38d-ee49348f2a00/export {"uuid": "6d2c03b2-98a4-4952-a38d-ee49348f2a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"} {"uuid": "6d2c03b2-98a4-4952-a38d-ee49348f2a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-50067", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"} https://vulnerability.circl.lu/sighting/6d2c03b2-98a4-4952-a38d-ee49348f2a00/export Thu, 02 Apr 2026 17:00:00 +0000