{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50207", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.969Z", "datePublished": "2024-11-08T06:07:57.780Z", "dateUpdated": "2026-08-05T11:42:30.399Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:42:30.399Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix reader locking when changing the sub buffer order\n\nThe function ring_buffer_subbuf_order_set() updates each\nring_buffer_per_cpu and installs new sub buffers that match the requested\npage order. This operation may be invoked concurrently with readers that\nrely on some of the modified data, such as the head bit (RB_PAGE_HEAD), or\nthe ring_buffer_per_cpu.pages and reader_page pointers. However, no\nexclusive access is acquired by ring_buffer_subbuf_order_set(). Modifying\nthe mentioned data while a reader also operates on them can then result in\nincorrect memory access and various crashes.\n\nFix the problem by taking the reader_lock when updating a specific\nring_buffer_per_cpu in ring_buffer_subbuf_order_set()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through tracefs file operations — write() to buffer_subbuf_size_kb racing read()/splice() on trace_pipe_raw or trace_pipe. There is no network or remote data path into ring_buffer_subbuf_order_set().\nAC:L - The attacker owns both sides of the race, running one thread that repeatedly toggles the sub-buffer order and another that continuously reads the per-CPU raw buffer, and can retry indefinitely with no reliance on external state. No condition beyond the attacker's control is required.\nPR:L - tracefs supports gid=/mode= delegation and real deployments (Android/Perfetto tracing group, ChromeOS, distro tracing groups) hand tracefs control files to unprivileged accounts, which is sufficient for both the resize and the concurrent read. The kernel CNA scored the follow-up locking fix to this exact function (CVE-2025-38101) at PR:L, and the higher-severity option is taken here.\nUI:N - The attacker's own threads perform both the sub-buffer order change and the concurrent buffer read; no victim action or interaction is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - ring_buffer_read_page() memcpy()s from cpu_buffer->reader_page->page after that page has been freed by the concurrent order change and potentially recycled for unrelated kernel data, copying it straight to userspace — a use-after-free read that leaks arbitrary kernel memory.\nI:H - Readers perform stores into freed sub-buffers and buffer_page structures (local_set on ->write/->entries, the rb_head_page_replace() cmpxchg, ->list.prev/next fixups, and reader->page assignment), and splice stale pages into the newly installed list — a use-after-free write plus linked-list corruption exploitable for control over kernel memory.\nA:H - The commit states the race results in \"incorrect memory access and various crashes\"; the corrupted ring-buffer list and freed-page accesses produce RB_WARN_ON splats and kernel oopses/panics." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/ring_buffer.c" ], "versions": [ { "version": "8e7b58c27b3c567316a51079b375b846f9223bba", "lessThan": "a569290525a05162d5dd26d9845591eaf46e5802", "status": "affected", "versionType": "git" }, { "version": "8e7b58c27b3c567316a51079b375b846f9223bba", "lessThan": "09661f75e75cb6c1d2d8326a70c311d46729235f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/ring_buffer.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.6", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a569290525a05162d5dd26d9845591eaf46e5802" }, { "url": "https://git.kernel.org/stable/c/09661f75e75cb6c1d2d8326a70c311d46729235f" } ], "title": "ring-buffer: Fix reader locking when changing the sub buffer order", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50207", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:17:32.092795Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-667", "description": "CWE-667 Improper Locking" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:27:06.537Z" } } ] } }