CVE-2024-38585

tools/nolibc/stdlib: fix memory error in realloc()

State: Published
Severity: Not scored
Published: Jun 19, 2024
Updated: May 11, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

tools/nolibc/stdlib: fix memory error in realloc()

Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 5996b2b2dac739f2a27da13de8eee5b85b2550b3Affected 0e0ff638400be8f497a35b51a4751fd823f6bd6a to before f678c3c336559cf3255a32153e9a17c1be4e7c15Affected 0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 8019d3dd921f39a237a9fab6d2ce716bfac0f983Affected 0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 4e6f225aefeb712cdb870176b6621f02cf235b8cAffected 0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 791f4641142e2aced85de082e5783b4fb0b977c2Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 5996b2b2dac739f2a27da13de8eee5b85b2550b3Affected
0e0ff638400be8f497a35b51a4751fd823f6bd6a to before f678c3c336559cf3255a32153e9a17c1be4e7c15Affected
0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 8019d3dd921f39a237a9fab6d2ce716bfac0f983Affected
0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 4e6f225aefeb712cdb870176b6621f02cf235b8cAffected
0e0ff638400be8f497a35b51a4751fd823f6bd6a to before 791f4641142e2aced85de082e5783b4fb0b977c2Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.