Fix out-of-bounds write in trie_get_next_key()
CVE-2024-50262
What is CVE-2024-50262?
The Linux kernel features a vulnerability within the BPF (Berkeley Packet Filter) module specifically in the trie_get_next_key() function, where an out-of-bounds write occurs. This function allocates a node stack based on trie->max_prefixlen but incorrectly writes nodes exceeding this limit. For instance, if the max_prefixlen is set to 8, inserting keys with a prefix of 0x00/0 through 0x00/8 attempts to write 9 nodes to the stack instead of the allocated 8. This flaw may lead to unintended memory corruption, potentially impacting system stability and security.
Affected Version(s)
Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd
Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd < 91afbc0eb3c90258ae378ae3c6ead3d2371e926d
Linux b471f2f1de8b816f1e799b80aa92588f3566e4bd < 590976f921723d53ac199c01d5b7b73a94875e68