Lucene search

LinuxCVE-2024-45020

HistorySep 11, 2024 - 4:15 p.m.

CVE-2024-45020

2024-09-1116:15:07

CWE-787

Linux

web.nvd.nist.gov

linux kernel

vulnerability

cve-2024-45020

kernel verifier

stacksafe()

memory access

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.2

Confidence

Low

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a kernel verifier crash in stacksafe()

Daniel Hodges reported a kernel verifier crash when playing with sched-ext.
Further investigation shows that the crash is due to invalid memory access
in stacksafe(). More specifically, it is the following code:

if (exact != NOT_EXACT &&
    old-&gt;stack[spi].slot_type[i % BPF_REG_SIZE] !=
    cur-&gt;stack[spi].slot_type[i % BPF_REG_SIZE])
        return false;

The ‘i’ iterates old->allocated_stack.
If cur->allocated_stack < old->allocated_stack the out-of-bound
access will happen.

To fix the issue add ‘i >= cur->allocated_stack’ check such that if
the condition is true, stacksafe() should fail. Otherwise,
cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.

Affected configurations

Nvd

Vulners

Node

linuxlinux_kernelRange6.6.15–6.6.48

linuxlinux_kernelRange6.7–6.10.7

linuxlinux_kernelMatch6.11rc1

linuxlinux_kernelMatch6.11rc2

linuxlinux_kernelMatch6.11rc3

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linuxlinux_kernel6.11cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
linuxlinux_kernel6.11cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
linuxlinux_kernel6.11cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.11	cpe:2.3:o:linux:linux_kernel:6.11:rc1::::::
linux	linux_kernel	6.11	cpe:2.3:o:linux:linux_kernel:6.11:rc2::::::
linux	linux_kernel	6.11	cpe:2.3:o:linux:linux_kernel:6.11:rc3::::::

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "kernel/bpf/verifier.c"
    ],
    "versions": [
      {
        "version": "ab470fefce28",
        "lessThan": "7cad3174cc79",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "2793a8b015f7",
        "lessThan": "6e3987ac310c",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "2793a8b015f7",
        "lessThan": "bed2eb964c70",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "kernel/bpf/verifier.c"
    ],
    "versions": [
      {
        "version": "6.7",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.7",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.48",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.7",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

References

git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b

git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08

git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.2

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2024-45020