Lucene search

K
debiancveDebian Security Bug TrackerDEBIANCVE:CVE-2024-46754
HistorySep 18, 2024 - 8:15 a.m.

CVE-2024-46754

2024-09-1808:15:04
Debian Security Bug Tracker
security-tracker.debian.org
bpf
lwt_seg6local_prog_ops
mitigation
vulnerability

AI Score

6.7

Confidence

High

EPSS

0

Percentile

9.6%

In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tst_run from lwt_seg6local_prog_ops. The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn’t work since it was introduced in commit 04d4b274e2a (“ipv6: sr: Add seg6local action End.BPF”). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.

AI Score

6.7

Confidence

High

EPSS

0

Percentile

9.6%

Related for DEBIANCVE:CVE-2024-46754