CVE-2024-50259

What it actually does

Missing null terminator after copy_from_user() in nsim_nexthop_bucket_activity_write() allows unterminated string passed to sscanf(), enabling out-of-bounds memory access or use of uninitialized data in the Linux kernel netdevsim module.

Why it matters to the business

Local kernel crashes or instability in networking simulation environments, potentially disrupting development, testing, or specialized Linux deployments with low overall operational risk due to limited module usage.

How an attack unfolds

A local attacker writes crafted data via the exposed interface without a trailing zero, triggering string operations on unterminated memory that can lead to kernel panic or information exposure in affected Linux kernels.

How to fix it

Update the Linux kernel to include commit c2150f666c6fc301d5d1643ed0f92251f1a0ff0d or later stable releases containing the trailing zero fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the presence of the null-termination code change in nsim_nexthop_bucket_activity_write() via source inspection or confirm running kernel version incorporates the referenced commit; test the interface with boundary inputs.

Typical attack path

1. Obtain local user access on a Linux system with netdevsim loaded
2. Locate and write to the nexthop bucket activity debug interface
3. Supply input lacking a null terminator after copy_from_user
4. Trigger sscanf or subsequent string handling to induce memory corruption
5. Observe denial of service via kernel crash or attempt further exploitation

How to detect it

Review kernel logs for oops/panic entries involving nsim_nexthop_bucket_activity_write or copy_from_user followed by sscanf; inspect audit logs for writes to netdevsim debugfs entries by non-root users.

What your security team should do

• Prioritize kernel updates on systems using netdevsim for development or simulation workloads
• Restrict local access to debug interfaces and consider disabling netdevsim if unused
• Monitor for kernel oops or panic events related to string handling in networking modules