CVE-2024-45020

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45020

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.

References
Link Resource
https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b Patch
https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08 Patch
https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
History

13 Sep 2024, 16:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b - () https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b - Patch
References () https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08 - () https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08 - Patch
References () https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25 - () https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25 - Patch
CWE CWE-787
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Se corrige un fallo del verificador del kernel en stacksafe() Daniel Hodges informó de un fallo del verificador del kernel al jugar con sched-ext. Una investigación más profunda muestra que el fallo se debe a un acceso a memoria no válido en stacksafe(). Más específicamente, es el siguiente código: if (exact != NOT_EXACT &amp;&amp; old-&gt;stack[spi].slot_type[i % BPF_REG_SIZE] != cur-&gt;stack[spi].slot_type[i % BPF_REG_SIZE]) return false; La 'i' itera old-&gt;allocated_stack. Si cur-&gt;allocated_stack &lt; old-&gt;allocated_stack, se producirá el acceso fuera de límites. Para solucionar el problema, agregue la comprobación 'i &gt;= cur-&gt;allocated_stack' de modo que, si la condición es verdadera, stacksafe() debería fallar. De lo contrario, el acceso a la memoria cur-&gt;stack[spi].slot_type[i % BPF_REG_SIZE] es legal.
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

11 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-11 16:15

Updated : 2024-09-13 16:36

NVD link : CVE-2024-45020

Mitre link : CVE-2024-45020

CVE.ORG link : CVE-2024-45020

JSON object : View

Products Affected

linux

CWE
CWE-787

Out-of-bounds Write