Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-27050
HistoryMay 01, 2024 - 12:00 a.m.

CVE-2024-27050

2024-05-0100:00:00
ubuntu.com
ubuntu.com
5
linux kernel
libbpf
vulnerability
stack corruption
exploit fix
security patch

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

In the Linux kernel, the following vulnerability has been resolved: libbpf:
Use OPTS_SET() macro in bpf_xdp_query() When the feature_flags and
xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the
code writing them did not use the OPTS_SET() macro. This causes libbpf to
write to those fields unconditionally, which means that programs compiled
against an older version of libbpf (with a smaller size of the
bpf_xdp_query_opts struct) will have its stack corrupted by libbpf writing
out of bounds. The patch adding the feature_flags field has an early bail
out if the feature_flags field is not part of the opts struct (via the
OPTS_HAS) macro, but the patch adding xdp_zc_max_segs does not. For
consistency, this fix just changes the assignments to both fields to use
the OPTS_SET() macro.

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%