Memory Safety Issue in Linux Kernel: CVE-2024-50134 in vboxvideo Package
Summary
CVE-2024-50134: In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with... Affects linux versions < 5.10.234-1. Fixed in 5.10.234-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and provides a stable environment for applications. The vboxvideo package is a driver for VirtualBox guest systems, enabling graphics acceleration and seamless mouse integration. This package is crucial for virtualized environments, but it has been found to contain a vulnerability that could lead to memory corruption.
Vulnerability Detail
CVE-2024-50134 is a vulnerability in the Linux kernel's vboxvideo driver, specifically related to the handling of mouse pointer shapes. The issue arises from the use of a fake variable-length array (VLA) at the end of the vbva_mouse_pointer_shape function, which leads to a 'memcpy: detected field-spanning write error' warning. This can potentially allow for memory corruption, leading to system instability or exploitation by an attacker. The warning indicates that the memory write operation exceeds the allocated buffer size, which could be exploited to overwrite adjacent memory.
How To Fix
Minimum fixed version
5.10.234-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
CVE-2024-50134 is a critical vulnerability in the Linux kernel's vboxvideo driver that poses risks of memory corruption and system instability. Users are advised to update their systems to the latest kernel version to mitigate these risks. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-50134 is a vulnerability in the Linux kernel's vboxvideo driver that can lead to memory corruption due to improper handling of mouse pointer shapes.
This vulnerability can potentially lead to system instability or exploitation, allowing an attacker to manipulate memory and execute arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch is available in the updated versions of the Linux kernel. Users should update their systems to the latest version to mitigate the risk.
While there are no specific workarounds, it is crucial to prioritize updating your system as soon as possible to protect against potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
