Fix out-of-bounds write in trie_get_next_key()
CVE-2024-50262

7.8HIGH

Key Information:

Vendor

Linux

Status
Vendor
CVE Published:
9 November 2024

What is CVE-2024-50262?

The Linux kernel features a vulnerability within the BPF (Berkeley Packet Filter) module specifically in the trie_get_next_key() function, where an out-of-bounds write occurs. This function allocates a node stack based on trie->max_prefixlen but incorrectly writes nodes exceeding this limit. For instance, if the max_prefixlen is set to 8, inserting keys with a prefix of 0x00/0 through 0x00/8 attempts to write 9 nodes to the stack instead of the allocated 8. This flaw may lead to unintended memory corruption, potentially impacting system stability and security.

Affected Version(s)

Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd

Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd < 91afbc0eb3c90258ae378ae3c6ead3d2371e926d

Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd < 590976f921723d53ac199c01d5b7b73a94875e68

References

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-50262 : Fix out-of-bounds write in trie_get_next_key()