CVE-2024-38576

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a buffer overflow in the print cpu stall info() function. This can occur when there is a huge difference in jiffies difference, causing the rcuc-starvation output to overflow the buffer. The situation might seem improbable, but computers sometimes get very confused about time, which can result in full-sized integers and, in this case, buffer overflow. Additionally, the unsigned jiffies difference is printed using %ld, which is normally for signed integers, and this is intentional for debugging purposes but not obvious from the code. The commit changes sprintf() to snprintf() and adds a clarifying comment about the intention of the %ld format.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.