CVE-2024-50165CWE-401

CVE-2024-50165

High · published November 7, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve param->string when parsing mount options

In bpf_parse_param(), keep the value of param->string intact so it can

be freed later. Otherwise, the kmalloc area pointed to by param->string

will be leaked as shown below:

unreferenced object 0xffff888118c46d20 (size 8):

comm "new_name", pid 12109, jiffies 4295580214

hex dump (first 8 bytes):

61 6e 79 00 38 c9 5c 7e any.8.\~

backtrace (crc e1b7f876):

[<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80

[<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0

[<000000003e29b886>] memdup_user+0x32/0xa0

[<0000000007248326>] strndup_user+0x46/0x60

[<0000000035b3dd29>] __x64_sys_fsconfig+0x368/0x3d0

[<0000000018657927>] x64_sys_call+0xff/0x9f0

[<00000000c0cabc95>] do_syscall_64+0x3b/0xc0

[<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.3th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2024-11-07T15:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.9, < 6.11.66.11.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 07 NOV 09:31Z
    bpf: Preserve param->string when parsing mount options
    cvelistv5