CVE-2024-50132

What it actually does

Incorrect ordering of nr_args assignment before truncation to MAX_TRACE_ARGS allows probes with over 128 fetchargs to perform uninitialized memory accesses, resulting in NULL pointer dereference during __set_print_fmt.

Why it matters to the business

Systems performing extensive kernel tracing can experience crashes or instability; high downstream prevalence increases exposure across many Linux environments and dependent packages.

How an attack unfolds

An attacker with ability to create trace probes supplies more than 128 fetch arguments, triggering the limit mishandling and causing kernel NULL dereference; listed threat actors in espionage and financial campaigns have targeted similar Linux kernel memory issues.

How to fix it

Update to fixed kernel commit 6bc24db74fe4788cc7c2f30a113fc6aafba225a3 or later; for listed Ubuntu ipython packages apply versions such as 2.4.1-1, 1.2.1-2ubuntu0.1~esm1, or 5.5.0-1.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; attempt to create a trace probe with 129 arguments and verify error is returned instead of silent truncation or crash.

Typical attack path

1. Obtain privileges sufficient to create trace probes (e.g., CAP_SYS_ADMIN or equivalent)
2. Invoke trace probe creation API with >128 fetchargs
3. Trigger argument setup path that skips initialization beyond MAX_TRACE_ARGS
4. Cause kernel NULL pointer dereference during print format setup

How to detect it

Search kernel logs for oops messages referencing __set_print_fmt and address 0000000000000020; review audit logs for trace probe creation events with unusually high argument counts.

• BUG: kernel NULL pointer dereference, address: 0000000000000020
• __set_print_fmt+0x134/0x330
• tracing/probes: too many arguments

What your security team should do

• Prioritize kernel updates on all production systems due to 348 downstream dependents and broad ecosystem reach
• Audit custom tracing scripts and tools for argument count exceeding 128
• Monitor for kernel oops involving __set_print_fmt after applying fixes