HighFix available
parport: Proper fix for array out-of-bounds access
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.19.323, 5.10.228, 5.15.169, 5.4.285, 6.1.114, 6.11.5, 6.6.58
- CVEs
- CVE-2024-50074
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 02:04 UTC · Revision 1
Source evidence
parport: Proper fix for array out-of-bounds access
core-osv · Original sourcePublished 29 Oct 2024, 00:50 UTC
In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.
osv:CVE-2024-50074
Kernel
Fixed versions: 4.19.323, 5.4.285, 5.10.228, 5.15.169, 6.1.114, 6.6.58, 6.11.5
Complete source record
{
"id": "8d9176af4c9cec53d25a36ccfc9aa4576cdc454786507500f1df6fba21d97db8",
"url": "https://osv.dev/vulnerability/CVE-2024-50074",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "parport: Proper fix for array out-of-bounds access",
"summary": "In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.",
"evidence": "osv:CVE-2024-50074",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.19.323",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.285",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.228",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.169",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.114",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.58",
"evidence": "/affected/1/ranges"
},
{
"value": "6.11.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2024-50074",
"aliases": [
"CVE-2024-50074"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "166a0bddcc27de41fe13f861c8348e8e53e988c8"
},
{
"fixed": "8aadef73ba3b325704ed5cfc4696a25c350182cf"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "47b3dce100778001cd76f7e9188944b5cb27a76d"
},
{
"fixed": "b0641e53e6cb937487b6cfb15772374f0ba149b3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0"
},
{
"fixed": "1826b6d69bbb7f9ae8711827facbb2ad7f8d0aaa"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c719b393374d3763e64900ee19aaed767d5a08d6"
},
{
"fixed": "440311903231c6e6c9bcf8acb6a2885a422e00bc"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7f4da759092a1a6ce35fb085182d02de8cc4cc84"
},
{
"fixed": "fca048f222ce9dcbde5708ba2bf81d85a4a27952"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b579ea3516c371ecf59d073772bc45dfd28c8a0e"
},
{
"fixed": "66029078fee00646e2e9dbb8f41ff7819f8e7569"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ab11dac93d2d568d151b1918d7b84c2d02bacbd5"
},
{
"fixed": "2a8b26a09c8e3ea03da1ef3cd0ef6b96e559fba6"
},
{
"fixed": "02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4.19.320"
},
{
"fixed": "4.19.323"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.282"
},
{
"fixed": "5.4.285"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.224"
},
{
"fixed": "5.10.228"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.165"
},
{
"fixed": "5.15.169"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.103"
},
{
"fixed": "6.1.114"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.44"
},
{
"fixed": "6.6.58"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.10.3"
},
{
"fixed": "6.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7789a1d6792af410aa9b39a1eb237ed24fa2170a"
}
]
}
],
"versions": [
"v4.19.322",
"v4.19.321",
"v4.19.320",
"v5.4.284",
"v5.4.283",
"v5.4.282",
"v5.10.227",
"v5.10.226",
"v5.10.225",
"v5.10.224",
"v5.15.168",
"v5.15.167",
"v5.15.166",
"v5.15.165",
"v6.1.113",
"v6.1.112",
"v6.1.111",
"v6.1.110",
"v6.1.109",
"v6.1.108",
"v6.1.107",
"v6.1.106",
"v6.1.105",
"v6.1.104",
"v6.1.103",
"v6.6.57",
"v6.6.56",
"v6.6.55",
"v6.6.54",
"v6.6.53",
"v6.6.52",
"v6.6.51",
"v6.6.50",
"v6.6.49",
"v6.6.48",
"v6.6.47",
"v6.6.46",
"v6.6.45",
"v6.6.44",
"v6.10.14",
"v6.10.13",
"v6.10.12",
"v6.10.11",
"v6.10.10",
"v6.10.9",
"v6.10.8",
"v6.10.7",
"v6.10.6",
"v6.10.5",
"v6.10.4",
"v6.10.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50074.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.19.323"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.285"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.228"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.169"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.114"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.58"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.11.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50074.json"
}
}
],
"modified": "2026-10-28T02:30:41.799494881Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9",
"https://git.kernel.org/stable/c/1826b6d69bbb7f9ae8711827facbb2ad7f8d0aaa",
"https://git.kernel.org/stable/c/2a8b26a09c8e3ea03da1ef3cd0ef6b96e559fba6",
"https://git.kernel.org/stable/c/440311903231c6e6c9bcf8acb6a2885a422e00bc",
"https://git.kernel.org/stable/c/66029078fee00646e2e9dbb8f41ff7819f8e7569",
"https://git.kernel.org/stable/c/8aadef73ba3b325704ed5cfc4696a25c350182cf",
"https://git.kernel.org/stable/c/b0641e53e6cb937487b6cfb15772374f0ba149b3",
"https://git.kernel.org/stable/c/fca048f222ce9dcbde5708ba2bf81d85a4a27952",
"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50074.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-50074",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50074.json"
}
},
"related_cves": [
{
"value": "CVE-2024-50074",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509320,
"published_at": "2024-10-29T00:50:16.263+00:00"
}