CVE-2024-46764CWE-125

CVE-2024-46764

High · published September 18, 2024

CVSS v3.1
7.3
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: add check for invalid name in btf_name_valid_section()

If the length of the name string is 1 and the value of name[0] is NULL

byte, an OOB vulnerability occurs in btf_name_valid_section() and the

return value is true, so the invalid name passes the check.

To solve this, you need to check if the first position is NULL byte and

if the first character is printable.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-09-18T12:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 6.9, < 6.10.106.10.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 18 SEP 07:12Z
    bpf: add check for invalid name in btf_name_valid_section()
    cvelistv5