GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-43910 (GCVE-0-2024-43910)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:11 – Updated: 2026-08-05 11:37
VLAI
Title
bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses Currently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to a global function as an argument. The adverse effects of this is that BPF helpers can continue to make use of this modified CONST_PTR_TO_DYNPTR from within the context of the global function, which can unintentionally result in out-of-bounds memory accesses and therefore compromise overall system stability i.e. [ 244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140 [ 244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302 [ 244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533 [ 244.174318] Call Trace: [ 244.175787] <TASK> [ 244.177356] dump_stack_lvl+0x66/0xa0 [ 244.179531] print_report+0xce/0x670 [ 244.182314] ? __virt_addr_valid+0x200/0x3e0 [ 244.184908] kasan_report+0xd7/0x110 [ 244.187408] ? bpf_dynptr_data+0x137/0x140 [ 244.189714] ? bpf_dynptr_data+0x137/0x140 [ 244.192020] bpf_dynptr_data+0x137/0x140 [ 244.194264] bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26 [ 244.198044] bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23 [ 244.202136] bpf_user_ringbuf_drain+0x2c7/0x570 [ 244.204744] ? 0xffffffffc0009e58 [ 244.206593] ? __pfx_bpf_user_ringbuf_drain+0x10/0x10 [ 244.209795] bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b [ 244.215922] bpf_trampoline_6442502480+0x43/0xe3 [ 244.218691] __x64_sys_prlimit64+0x9/0xf0 [ 244.220912] do_syscall_64+0xc1/0x1d0 [ 244.223043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.226458] RIP: 0033:0x7ffa3eb8f059 [ 244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48 [ 244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e [ 244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059 [ 244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0 [ 244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000 [ 244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80 [ 244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000 [ 244.268303] </TASK> Add a check_func_arg_reg_off() to the path in which the BPF verifier verifies the arguments of global function arguments, specifically those which take an argument of type ARG_PTR_TO_DYNPTR | MEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any explicit and strict type matching on the supplied register type, so let's also enforce that a register either type PTR_TO_STACK or CONST_PTR_TO_DYNPTR is by the caller.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:28 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a64bfe618665ea9c722f922cba8c6e3234eac5ac , < 13663a7c644bf1dedaf461d07252db5d76c8759a (git)
Affected: a64bfe618665ea9c722f922cba8c6e3234eac5ac , < ec2b9a5e11e51fea1bb04c1e7e471952e887e874 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:28:19.098639Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:07.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13663a7c644bf1dedaf461d07252db5d76c8759a",
              "status": "affected",
              "version": "a64bfe618665ea9c722f922cba8c6e3234eac5ac",
              "versionType": "git"
            },
            {
              "lessThan": "ec2b9a5e11e51fea1bb04c1e7e471952e887e874",
              "status": "affected",
              "version": "a64bfe618665ea9c722f922cba8c6e3234eac5ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\n\nCurrently, it\u0027s possible to pass in a modified CONST_PTR_TO_DYNPTR to\na global function as an argument. The adverse effects of this is that\nBPF helpers can continue to make use of this modified\nCONST_PTR_TO_DYNPTR from within the context of the global function,\nwhich can unintentionally result in out-of-bounds memory accesses and\ntherefore compromise overall system stability i.e.\n\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\n[  244.174318] Call Trace:\n[  244.175787]  \u003cTASK\u003e\n[  244.177356]  dump_stack_lvl+0x66/0xa0\n[  244.179531]  print_report+0xce/0x670\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\n[  244.184908]  kasan_report+0xd7/0x110\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\n[  244.192020]  bpf_dynptr_data+0x137/0x140\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\n[  244.204744]  ? 0xffffffffc0009e58\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\n[  244.220912]  do_syscall_64+0xc1/0x1d0\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\n[  244.268303]  \u003c/TASK\u003e\n\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\nverifies the arguments of global function arguments, specifically\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\nMEM_RDONLY. Also, process_dynptr_func() doesn\u0027t appear to perform any\nexplicit and strict type matching on the supplied register type, so\nlet\u0027s also enforce that a register either type PTR_TO_STACK or\nCONST_PTR_TO_DYNPTR is by the caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only trigger is `BPF_BTF_LOAD` plus `BPF_PROG_LOAD` on the `bpf(2)` syscall followed by running the program; no remote or adjacent peer data reaches `btf_check_func_arg_match()`. This matches the standard BPF-subsystem classification of Local.\nAC:L - The attacker supplies the offset himself as a `BPF_ALU64_IMM(BPF_ADD, R1, K)` immediate, which `can_skip_alu_sanitation()` exempts from all speculative masking and `adjust_ptr_min_max_vals()` folds verbatim into `dst_reg-\u003eoff`, so every precondition is chosen at program-authoring time. There is no race, no memory-layout luck, and no non-default config \u2014 global subprogs and dynptrs are ordinary CO-RE/libbpf features.\nPR:L - Reaching the path needs CAP_BPF, which is not root and which `bpf_token_capable()` deliberately grants at `ns_capable()` level through a delegated bpffs BPF token \u2014 a feature present throughout the affected 6.8\u20136.10 range \u2014 so an unprivileged user in a container or a non-root CAP_BPF service account qualifies. CAP_BPF is specifically not supposed to confer kernel memory access; the verifier is the boundary being broken here.\nUI:N - The attacker loads and triggers his own BPF program end to end via the `bpf(2)` syscall and a self-attached hook. No victim action of any kind is involved.\nS:U - The forged dynptr corrupts kernel memory within the same kernel security authority that the BPF program already runs under. No hypervisor, IOMMU, or other authority boundary is crossed.\nC:H - With `data`/`size`/`offset` read out of an attacker-placed fake `struct bpf_dynptr_kern`, `bpf_dynptr_read()` performs a `memcpy` from `ptr-\u003edata + ptr-\u003eoffset` into the program\u0027s stack, yielding an arbitrary kernel read of up to the 24-bit size mask; the committed KASAN report is only the mildest manifestation.\nI:H - `bpf_dynptr_write()` takes `ARG_PTR_TO_DYNPTR | MEM_RDONLY` and so accepts the same forged pointer inside the subprog, reaching `memmove(dst-\u003edata + dst-\u003eoffset + offset, src, len)` \u2014 an arbitrary kernel write, and `bpf_dynptr_data()` additionally hands back a `PTR_TO_MEM` slice at that address. That is a direct local privilege-escalation primitive.\nA:H - Even without exploitation, dereferencing `real_dynptr + K` for an arbitrary `s32` K reads a wild kernel address, producing the slab-out-of-bounds splat in the commit message and, for offsets into unmapped memory, an oops that panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:04.139Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874"
        }
      ],
      "title": "bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43910",
    "datePublished": "2024-08-26T10:11:14.105Z",
    "dateReserved": "2024-08-17T09:11:59.294Z",
    "dateUpdated": "2026-08-05T11:37:04.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43910",
      "date": "2026-09-16",
      "epss": "0.00189",
      "percentile": "0.08811"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.10.5\", \"matchCriteriaId\": \"48E239A0-A959-4FAB-8475-D045FED3DDA5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\\n\\nCurrently, it\u0027s possible to pass in a modified CONST_PTR_TO_DYNPTR to\\na global function as an argument. The adverse effects of this is that\\nBPF helpers can continue to make use of this modified\\nCONST_PTR_TO_DYNPTR from within the context of the global function,\\nwhich can unintentionally result in out-of-bounds memory accesses and\\ntherefore compromise overall system stability i.e.\\n\\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\\n[  244.174318] Call Trace:\\n[  244.175787]  \u003cTASK\u003e\\n[  244.177356]  dump_stack_lvl+0x66/0xa0\\n[  244.179531]  print_report+0xce/0x670\\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\\n[  244.184908]  kasan_report+0xd7/0x110\\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\\n[  244.192020]  bpf_dynptr_data+0x137/0x140\\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\\n[  244.204744]  ? 0xffffffffc0009e58\\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\\n[  244.220912]  do_syscall_64+0xc1/0x1d0\\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\\n[  244.268303]  \u003c/TASK\u003e\\n\\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\\nverifies the arguments of global function arguments, specifically\\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\\nMEM_RDONLY. Also, process_dynptr_func() doesn\u0027t appear to perform any\\nexplicit and strict type matching on the supplied register type, so\\nlet\u0027s also enforce that a register either type PTR_TO_STACK or\\nCONST_PTR_TO_DYNPTR is by the caller.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: agrega check_func_arg_reg_off() faltante para evitar accesos a memoria fuera de los l\\u00edmites. Actualmente, es posible pasar un CONST_PTR_TO_DYNPTR modificado a una funci\\u00f3n global como argumento. Los efectos adversos de esto es que los asistentes de BPF pueden continuar haciendo uso de este CONST_PTR_TO_DYNPTR modificado desde dentro del contexto de la funci\\u00f3n global, lo que puede resultar involuntariamente en accesos a la memoria fuera de los l\\u00edmites y, por lo tanto, comprometer la estabilidad general del sistema, es decir, [244.157771] ERROR : KASAN: losa fuera de los l\\u00edmites en bpf_dynptr_data+0x137/0x140 [244.161345] Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff88810914be68 por tarea test_progs/302 [244.167151] CPU: 0 PID: 302 Comm: test_progs Contaminado: GOE 6.10.0- rc3-00131-g66b586715063 #533 [244.174318] Seguimiento de llamadas: [244.175787]  [244.177356] dump_stack_lvl+0x66/0xa0 [244.179531] print_report+0xce/0x670 [244. 182314] ? __virt_addr_valid+0x200/0x3e0 [ 244.184908] kasan_report+0xd7/0x110 [ 244.187408] ? bpf_dynptr_data+0x137/0x140 [244.189714]? bpf_dynptr_data+0x137/0x140 [ 244.192020] bpf_dynptr_data+0x137/0x140 [ 244.194264] bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26 [ 244. 198044] bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23 [ 244.202136] bpf_user_ringbuf_drain+0x2c7/0x570 [ 244.204744] ? 0xffffffffc0009e58 [244.206593]? __pfx_bpf_user_ringbuf_drain+0x10/0x10 [ 244.209795] bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b [ 244.215922] 2502480+0x43/0xe3 [ 244.218691] __x64_sys_prlimit64+0x9/0xf0 [ 244.220912] do_syscall_64+0xc1/0x1d0 [ 244.223043] Entry_SYSCALL_64_after_hwframe+0x77/0x7f [244.226458] QEPD: 0033:0x7ffa3eb8f059 [ 244.228582] C\\u00f3digo: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48 [ 244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 0000000012e [ 244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059 [ 244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0 [ 244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R 09: 0000000000000000 [ 244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80 [ 244.264201] R13: 000000000000001c R 14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000 [ 244.268303 ]  Agregue un check_func_arg_reg_off() a la ruta en la que el verificador BPF verifica los argumentos de las funciones globales, espec\\u00edficamente aquellos que toman un argumento de tipo ARG_PTR_TO_DYNPTR | MEM_RDONLY. Adem\\u00e1s, Process_dynptr_func() no parece realizar ninguna coincidencia de tipos expl\\u00edcita y estricta en el tipo de registro proporcionado, por lo que tambi\\u00e9n hagamos cumplir que un registro del tipo PTR_TO_STACK o CONST_PTR_TO_DYNPTR est\\u00e9 a cargo de la persona que llama.\"}]",
      "id": "CVE-2024-43910",
      "lastModified": "2024-09-05T18:30:23.437",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-26T11:15:05.177",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43910\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-26T11:15:05.177\",\"lastModified\":\"2026-08-04T11:19:59.747\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\\n\\nCurrently, it\u0027s possible to pass in a modified CONST_PTR_TO_DYNPTR to\\na global function as an argument. The adverse effects of this is that\\nBPF helpers can continue to make use of this modified\\nCONST_PTR_TO_DYNPTR from within the context of the global function,\\nwhich can unintentionally result in out-of-bounds memory accesses and\\ntherefore compromise overall system stability i.e.\\n\\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\\n[  244.174318] Call Trace:\\n[  244.175787]  \u003cTASK\u003e\\n[  244.177356]  dump_stack_lvl+0x66/0xa0\\n[  244.179531]  print_report+0xce/0x670\\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\\n[  244.184908]  kasan_report+0xd7/0x110\\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\\n[  244.192020]  bpf_dynptr_data+0x137/0x140\\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\\n[  244.204744]  ? 0xffffffffc0009e58\\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\\n[  244.220912]  do_syscall_64+0xc1/0x1d0\\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\\n[  244.268303]  \u003c/TASK\u003e\\n\\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\\nverifies the arguments of global function arguments, specifically\\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\\nMEM_RDONLY. Also, process_dynptr_func() doesn\u0027t appear to perform any\\nexplicit and strict type matching on the supplied register type, so\\nlet\u0027s also enforce that a register either type PTR_TO_STACK or\\nCONST_PTR_TO_DYNPTR is by the caller.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: agrega check_func_arg_reg_off() faltante para evitar accesos a memoria fuera de los l\u00edmites. Actualmente, es posible pasar un CONST_PTR_TO_DYNPTR modificado a una funci\u00f3n global como argumento. Los efectos adversos de esto es que los asistentes de BPF pueden continuar haciendo uso de este CONST_PTR_TO_DYNPTR modificado desde dentro del contexto de la funci\u00f3n global, lo que puede resultar involuntariamente en accesos a la memoria fuera de los l\u00edmites y, por lo tanto, comprometer la estabilidad general del sistema, es decir, [244.157771] ERROR : KASAN: losa fuera de los l\u00edmites en bpf_dynptr_data+0x137/0x140 [244.161345] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff88810914be68 por tarea test_progs/302 [244.167151] CPU: 0 PID: 302 Comm: test_progs Contaminado: GOE 6.10.0- rc3-00131-g66b586715063 #533 [244.174318] Seguimiento de llamadas: [244.175787]  [244.177356] dump_stack_lvl+0x66/0xa0 [244.179531] print_report+0xce/0x670 [244. 182314] ? __virt_addr_valid+0x200/0x3e0 [ 244.184908] kasan_report+0xd7/0x110 [ 244.187408] ? bpf_dynptr_data+0x137/0x140 [244.189714]? bpf_dynptr_data+0x137/0x140 [ 244.192020] bpf_dynptr_data+0x137/0x140 [ 244.194264] bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26 [ 244. 198044] bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23 [ 244.202136] bpf_user_ringbuf_drain+0x2c7/0x570 [ 244.204744] ? 0xffffffffc0009e58 [244.206593]? __pfx_bpf_user_ringbuf_drain+0x10/0x10 [ 244.209795] bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b [ 244.215922] 2502480+0x43/0xe3 [ 244.218691] __x64_sys_prlimit64+0x9/0xf0 [ 244.220912] do_syscall_64+0xc1/0x1d0 [ 244.223043] Entry_SYSCALL_64_after_hwframe+0x77/0x7f [244.226458] QEPD: 0033:0x7ffa3eb8f059 [ 244.228582] C\u00f3digo: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48 [ 244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 0000000012e [ 244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059 [ 244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0 [ 244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R 09: 0000000000000000 [ 244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80 [ 244.264201] R13: 000000000000001c R 14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000 [ 244.268303 ]  Agregue un check_func_arg_reg_off() a la ruta en la que el verificador BPF verifica los argumentos de las funciones globales, espec\u00edficamente aquellos que toman un argumento de tipo ARG_PTR_TO_DYNPTR | MEM_RDONLY. Adem\u00e1s, Process_dynptr_func() no parece realizar ninguna coincidencia de tipos expl\u00edcita y estricta en el tipo de registro proporcionado, por lo que tambi\u00e9n hagamos cumplir que un registro del tipo PTR_TO_STACK o CONST_PTR_TO_DYNPTR est\u00e9 a cargo de la persona que llama.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a64bfe618665ea9c722f922cba8c6e3234eac5ac\",\"lessThan\":\"13663a7c644bf1dedaf461d07252db5d76c8759a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a64bfe618665ea9c722f922cba8c6e3234eac5ac\",\"lessThan\":\"ec2b9a5e11e51fea1bb04c1e7e471952e887e874\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.5\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:28:19.098639Z\",\"id\":\"CVE-2024-43910\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"48E239A0-A959-4FAB-8475-D045FED3DDA5\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:18:05+00:00",
      "cve": "CVE-2024-43910",
      "id": "CVE-2024-43910",
      "initial_release_date": "2024-08-26T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43910.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:14:19Z",
      "cve": "CVE-2024-43910",
      "id": "CVE-2024-43910",
      "initial_release_date": "2024-09-08T02:47:22Z",
      "product_status:known_not_affected": "400",
      "product_status:recommended": "43",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43910",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43910.json",
      "version": "22"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43910\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:28:19.098639Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.947Z\"}}], \"cna\": {\"title\": \"bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a64bfe618665ea9c722f922cba8c6e3234eac5ac\", \"lessThan\": \"13663a7c644bf1dedaf461d07252db5d76c8759a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a64bfe618665ea9c722f922cba8c6e3234eac5ac\", \"lessThan\": \"ec2b9a5e11e51fea1bb04c1e7e471952e887e874\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a\"}, {\"url\": \"https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\\n\\nCurrently, it\u0027s possible to pass in a modified CONST_PTR_TO_DYNPTR to\\na global function as an argument. The adverse effects of this is that\\nBPF helpers can continue to make use of this modified\\nCONST_PTR_TO_DYNPTR from within the context of the global function,\\nwhich can unintentionally result in out-of-bounds memory accesses and\\ntherefore compromise overall system stability i.e.\\n\\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\\n[  244.174318] Call Trace:\\n[  244.175787]  \u003cTASK\u003e\\n[  244.177356]  dump_stack_lvl+0x66/0xa0\\n[  244.179531]  print_report+0xce/0x670\\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\\n[  244.184908]  kasan_report+0xd7/0x110\\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\\n[  244.192020]  bpf_dynptr_data+0x137/0x140\\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\\n[  244.204744]  ? 0xffffffffc0009e58\\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\\n[  244.220912]  do_syscall_64+0xc1/0x1d0\\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\\n[  244.268303]  \u003c/TASK\u003e\\n\\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\\nverifies the arguments of global function arguments, specifically\\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\\nMEM_RDONLY. Also, process_dynptr_func() doesn\u0027t appear to perform any\\nexplicit and strict type matching on the supplied register type, so\\nlet\u0027s also enforce that a register either type PTR_TO_STACK or\\nCONST_PTR_TO_DYNPTR is by the caller.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:32:08.384Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43910\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:32:08.384Z\", \"dateReserved\": \"2024-08-17T09:11:59.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:11:14.105Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.