CVE-2024-42301

dev/parport: fix the array out-of-bounds risk

State: Published
Severity: 7.8 High
Published: Aug 17, 2024
Updated: Aug 5, 2026
Reserved: Jul 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

dev/parport: fix the array out-of-bounds risk

Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed.

Below is the stack trace I encountered during the actual issue:

[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 166a0bddcc27de41fe13f861c8348e8e53e988c8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 47b3dce100778001cd76f7e9188944b5cb27a76dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c719b393374d3763e64900ee19aaed767d5a08d6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f4da759092a1a6ce35fb085182d02de8cc4cc84Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b579ea3516c371ecf59d073772bc45dfd28c8a0eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7789a1d6792af410aa9b39a1eb237ed24fa2170aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ab11dac93d2d568d151b1918d7b84c2d02bacbd5Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.19.320 through 4.19.Not affected 5.4.282 through 5.4.Not affected 5.10.224 through 5.10.Not affected 5.15.165 through 5.15.Not affected 6.1.103 through 6.1.Not affected 6.6.44 through 6.6.Not affected 6.10.3 through 6.10.*Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 166a0bddcc27de41fe13f861c8348e8e53e988c8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 47b3dce100778001cd76f7e9188944b5cb27a76dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c719b393374d3763e64900ee19aaed767d5a08d6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f4da759092a1a6ce35fb085182d02de8cc4cc84Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b579ea3516c371ecf59d073772bc45dfd28c8a0eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7789a1d6792af410aa9b39a1eb237ed24fa2170aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ab11dac93d2d568d151b1918d7b84c2d02bacbd5Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.19.320 through 4.19.*Not affected
5.4.282 through 5.4.*Not affected
5.10.224 through 5.10.*Not affected
5.15.165 through 5.15.*Not affected
6.1.103 through 6.1.*Not affected
6.6.44 through 6.6.*Not affected
6.10.3 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.