Executive Summary

Informations
Name CVE-2024-50161 First vendor Publication 2024-11-07
Vendor Cve Last vendor Modification 2024-11-13

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the remaining info_cnt before repeating btf fields

When trying to repeat the btf fields for array of nested struct, it doesn't check the remaining info_cnt. The following splat will be reported when the value of ret * nelems is greater than BTF_FIELDS_MAX:

------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49
index 11 is out of range for type 'btf_field_info [11]'
CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...
Call Trace:

dump_stack_lvl+0x57/0x70
dump_stack+0x10/0x20
ubsan_epilogue+0x9/0x40
__ubsan_handle_out_of_bounds+0x6f/0x80
? kallsyms_lookup_name+0x48/0xb0
btf_parse_fields+0x992/0xce0
map_create+0x591/0x770
__sys_bpf+0x229/0x2410
__x64_sys_bpf+0x1f/0x30
x64_sys_call+0x199/0x9f0
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7fea56f2cc5d
......

---[ end trace ]---

Fix it by checking the remaining info_cnt in btf_repeat_fields() before repeating the btf fields.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50161

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-129 Improper Validation of Array Index

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3662

Sources (Detail)

https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71
https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2025-01-08 03:06:53
  • Multiple Updates
2025-01-07 03:06:26
  • Multiple Updates
2024-12-25 03:05:03
  • Multiple Updates
2024-12-12 03:07:59
  • Multiple Updates
2024-11-23 03:04:47
  • Multiple Updates
2024-11-22 00:23:00
  • Multiple Updates
2024-11-19 21:20:52
  • Multiple Updates
2024-11-14 00:20:47
  • Multiple Updates
2024-11-13 21:21:03
  • Multiple Updates
2024-11-09 00:27:30
  • Multiple Updates
2024-11-07 13:27:34
  • First insertion