CVE-2024-50131

In the Linux kernel, the following vulnerability has been resolved:

tracing: Consider the NULL character when validating the event length

strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character.

This commit checks this condition and returns failure for it.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local administrative privileges to interact with the kernel tracing subsystem, restricting the blast radius to a localized denial of service. In default Red Hat deployments, access to the tracefs interface is strictly confined to the root user or processes holding elevated capabilities such as CAP_SYS_ADMIN. Consequently, unprivileged local users and remote actors cannot interact with the affected event registration mechanism to trigger the buffer termination failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.