CVE-2024-27050CWE-787

CVE-2024-27050

High · published May 1, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Use OPTS_SET() macro in bpf_xdp_query()

When the feature_flags and xdp_zc_max_segs fields were added to the libbpf

bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.

This causes libbpf to write to those fields unconditionally, which means

that programs compiled against an older version of libbpf (with a smaller

size of the bpf_xdp_query_opts struct) will have its stack corrupted by

libbpf writing out of bounds.

The patch adding the feature_flags field has an early bail out if the

feature_flags field is not part of the opts struct (via the OPTS_HAS)

macro, but the patch adding xdp_zc_max_segs does not. For consistency, this

fix just changes the assignments to both fields to use the OPTS_SET()

macro.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00285 · 20.0th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2024-05-01T17:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.6, < 6.6.236.6.23
linux/linux_kernel≥ 6.7, < 6.7.116.7.11
linux/linux_kernel≥ 6.8, < 6.8.26.8.2
References (8)
EPSS history
Timeline
  • 01 MAY 12:54Z
    libbpf: Use OPTS_SET() macro in bpf_xdp_query()
    cvelistv5