CVE-2024-58060 (GCVE-0-2024-58060)

Vulnerability from cvelistv5 – Published: 2025-03-06 15:54 – Updated: 2026-08-05 11:47
VLAI
Title
bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a "struct module *owner" member. For struct_ops that has a "struct module *owner" member, it can be extended either by the regular kernel module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is done based on the owner pointer. When CONFIG_MODULES=n, the btf_id of the "struct module" is missing: WARN: resolve_btfids: unresolved symbol module Thus, the bpf_try_module_get() cannot do the correct refcounting. Not all subsystem's struct_ops requires the "struct module *owner" member. e.g. the recent sched_ext_ops. This patch is to disable bpf_struct_ops registration if the struct_ops has the "struct module *" member and the "struct module" btf_id is missing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test. This has happened since the beginning of bpf_struct_ops which has gone through many changes. The Fixes tag is set to a recent commit that this patch can apply cleanly. Considering CONFIG_MODULES=n is not common and the age of the issue, targeting for bpf-next also.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-06 16:04 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1611603537a4b88cec7993f32b70c03113801a46 , < b777b14c2a4a4e2322daf8e8ffd42d2b88831b17 (git)
Affected: 1611603537a4b88cec7993f32b70c03113801a46 , < 2324fb4e92092837ee278fdd8d60c48ee1a619ce (git)
Affected: 1611603537a4b88cec7993f32b70c03113801a46 , < 96ea081ed52bf077cad6d00153b6fba68e510767 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-58060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T16:04:02.766596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T16:04:30.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/btf.h",
            "kernel/bpf/bpf_struct_ops.c",
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b777b14c2a4a4e2322daf8e8ffd42d2b88831b17",
              "status": "affected",
              "version": "1611603537a4b88cec7993f32b70c03113801a46",
              "versionType": "git"
            },
            {
              "lessThan": "2324fb4e92092837ee278fdd8d60c48ee1a619ce",
              "status": "affected",
              "version": "1611603537a4b88cec7993f32b70c03113801a46",
              "versionType": "git"
            },
            {
              "lessThan": "96ea081ed52bf077cad6d00153b6fba68e510767",
              "status": "affected",
              "version": "1611603537a4b88cec7993f32b70c03113801a46",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/btf.h",
            "kernel/bpf/bpf_struct_ops.c",
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing\n\nThere is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n.\nIn particular, the report is on tcp_congestion_ops that has\na \"struct module *owner\" member.\n\nFor struct_ops that has a \"struct module *owner\" member,\nit can be extended either by the regular kernel module or\nby the bpf_struct_ops. bpf_try_module_get() will be used\nto do the refcounting and different refcount is done\nbased on the owner pointer. When CONFIG_MODULES=n,\nthe btf_id of the \"struct module\" is missing:\n\nWARN: resolve_btfids: unresolved symbol module\n\nThus, the bpf_try_module_get() cannot do the correct refcounting.\n\nNot all subsystem\u0027s struct_ops requires the \"struct module *owner\" member.\ne.g. the recent sched_ext_ops.\n\nThis patch is to disable bpf_struct_ops registration if\nthe struct_ops has the \"struct module *\" member and the\n\"struct module\" btf_id is missing. The btf_type_is_fwd() helper\nis moved to the btf.h header file for this test.\n\nThis has happened since the beginning of bpf_struct_ops which has gone\nthrough many changes. The Fixes tag is set to a recent commit that this\npatch can apply cleanly. Considering CONFIG_MODULES=n is not\ncommon and the age of the issue, targeting for bpf-next also."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack is driven entirely through local syscalls \u2014 bpf(BPF_MAP_CREATE/MAP_UPDATE_ELEM/LINK_CREATE) to register the struct_ops congestion control, setsockopt(TCP_CONGESTION) to bind a socket to it, and close() to drop the map. Although the freed object is subsequently dereferenced while processing TCP ACKs, a remote peer cannot perform the registration/free setup.\nAC:L - On an affected kernel every step is deterministic and attacker-driven \u2014 register the struct_ops, attach it to a socket the attacker owns, close the fds to free the map, then drive traffic over loopback to hit the dangling icsk_ca_ops; there is no race and no dependence on memory layout the attacker cannot influence. The build-time CONFIG_MODULES=n precondition defines the vulnerable configuration rather than a condition to be won at exploit time, and it is trivially observable in advance (absent /proc/modules).\nPR:L - Creating the struct_ops map goes through bpf_token_capable(token, CAP_BPF), which BPF tokens explicitly delegate into unprivileged container user namespaces \u2014 the model container runtimes and BPF agents routinely use \u2014 and the socket, setsockopt(TCP_CONGESTION) and loopback-traffic halves of the attack need no capability at all.\nUI:N - The attacker performs the entire sequence with its own process, sockets and file descriptors; no victim action, mount, or configuration change by another user is required.\nS:U - The dangling tcp_congestion_ops pointer is dereferenced by the same kernel the attacker already has local access to; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed st_map allocation holding kvalue.data can be reclaimed and shaped by the attacker while sockets still read through icsk_ca_ops, turning the stale pointer into a controlled kernel-memory read primitive that leaks arbitrary kernel data.\nI:H - The kernel makes indirect calls through function pointers in the freed tcp_congestion_ops and into freed trampoline/bpf_prog_pack executable pages, giving a direct control-flow hijack primitive after heap or exec-page reclaim \u2014 full arbitrary write and code execution in kernel context.\nA:H - Even unweaponized, the use-after-free causes an oops or panic on the next congestion-control callback, and installing the bpf CA as the netns default poisons every new TCP socket in that namespace, wedging the network stack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:30.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b777b14c2a4a4e2322daf8e8ffd42d2b88831b17"
        },
        {
          "url": "https://git.kernel.org/stable/c/2324fb4e92092837ee278fdd8d60c48ee1a619ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/96ea081ed52bf077cad6d00153b6fba68e510767"
        }
      ],
      "title": "bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58060",
    "datePublished": "2025-03-06T15:54:03.253Z",
    "dateReserved": "2025-03-06T15:52:09.179Z",
    "dateUpdated": "2026-08-05T11:47:30.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58060",
      "date": "2026-09-30",
      "epss": "0.00205",
      "percentile": "0.09423"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/btf.h",
                  "kernel/bpf/bpf_struct_ops.c",
                  "kernel/bpf/btf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b777b14c2a4a4e2322daf8e8ffd42d2b88831b17",
                    "status": "affected",
                    "version": "1611603537a4b88cec7993f32b70c03113801a46",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2324fb4e92092837ee278fdd8d60c48ee1a619ce",
                    "status": "affected",
                    "version": "1611603537a4b88cec7993f32b70c03113801a46",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96ea081ed52bf077cad6d00153b6fba68e510767",
                    "status": "affected",
                    "version": "1611603537a4b88cec7993f32b70c03113801a46",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/btf.h",
                  "kernel/bpf/bpf_struct_ops.c",
                  "kernel/bpf/btf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AF4DF509-8040-448A-9D90-DDFA1A298CFE",
                    "versionEndExcluding": "6.12.13",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3",
                    "versionEndExcluding": "6.13.2",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing\n\nThere is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n.\nIn particular, the report is on tcp_congestion_ops that has\na \"struct module *owner\" member.\n\nFor struct_ops that has a \"struct module *owner\" member,\nit can be extended either by the regular kernel module or\nby the bpf_struct_ops. bpf_try_module_get() will be used\nto do the refcounting and different refcount is done\nbased on the owner pointer. When CONFIG_MODULES=n,\nthe btf_id of the \"struct module\" is missing:\n\nWARN: resolve_btfids: unresolved symbol module\n\nThus, the bpf_try_module_get() cannot do the correct refcounting.\n\nNot all subsystem\u0027s struct_ops requires the \"struct module *owner\" member.\ne.g. the recent sched_ext_ops.\n\nThis patch is to disable bpf_struct_ops registration if\nthe struct_ops has the \"struct module *\" member and the\n\"struct module\" btf_id is missing. The btf_type_is_fwd() helper\nis moved to the btf.h header file for this test.\n\nThis has happened since the beginning of bpf_struct_ops which has gone\nthrough many changes. The Fixes tag is set to a recent commit that this\npatch can apply cleanly. Considering CONFIG_MODULES=n is not\ncommon and the age of the issue, targeting for bpf-next also."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Rechazar el registro de struct_ops que usa el m\u00f3dulo ptr y falta el m\u00f3dulo btf_id Hay un informe UAF en bpf_struct_ops cuando CONFIG_MODULES=n. En particular, el informe est\u00e1 en tcp_congestion_ops que tiene un miembro \"struct module *owner\". Para struct_ops que tiene un miembro \"struct module *owner\", puede extenderse mediante el m\u00f3dulo de kernel regular o mediante bpf_struct_ops. bpf_try_module_get() se usar\u00e1 para hacer el recuento de referencias y se realiza un recuento de referencias diferente seg\u00fan el puntero del propietario. Cuando CONFIG_MODULES=n, falta el btf_id del \"struct module\": WARN: resolve_btfids: m\u00f3dulo de s\u00edmbolo sin resolver Por lo tanto, bpf_try_module_get() no puede hacer el recuento de referencias correcto. No todos los struct_ops de los subsistemas requieren el miembro \"struct module *owner\", por ejemplo, el reciente sched_ext_ops. Este parche sirve para deshabilitar el registro de bpf_struct_ops si struct_ops tiene el miembro \"struct module *\" y falta el btf_id \"struct module\". El asistente btf_type_is_fwd() se ha movido al archivo de encabezado btf.h para esta prueba. Esto ha sucedido desde el comienzo de bpf_struct_ops, que ha sufrido muchos cambios. La etiqueta Fixes se establece en una confirmaci\u00f3n reciente que este parche puede aplicar sin problemas. Teniendo en cuenta que CONFIG_MODULES=n no es com\u00fan y la antig\u00fcedad del problema, tambi\u00e9n se apunta a bpf-next."
          }
        ],
        "id": "CVE-2024-58060",
        "lastModified": "2026-06-17T08:14:32.227",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-58060",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T16:04:02.766596Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-06T16:15:52.230",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2324fb4e92092837ee278fdd8d60c48ee1a619ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/96ea081ed52bf077cad6d00153b6fba68e510767"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b777b14c2a4a4e2322daf8e8ffd42d2b88831b17"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:00:56+00:00",
      "cve": "CVE-2024-58060",
      "id": "CVE-2024-58060",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58060.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:34:37Z",
      "cve": "CVE-2024-58060",
      "id": "CVE-2024-58060",
      "initial_release_date": "2025-03-07T02:39:09Z",
      "product_status:known_not_affected": "503",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-58060",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-58060.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-58060",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-06T16:04:02.766596Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-06T16:04:04.391Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/linux/btf.h",
                "kernel/bpf/bpf_struct_ops.c",
                "kernel/bpf/btf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b777b14c2a4a4e2322daf8e8ffd42d2b88831b17",
                  "status": "affected",
                  "version": "1611603537a4b88cec7993f32b70c03113801a46",
                  "versionType": "git"
                },
                {
                  "lessThan": "2324fb4e92092837ee278fdd8d60c48ee1a619ce",
                  "status": "affected",
                  "version": "1611603537a4b88cec7993f32b70c03113801a46",
                  "versionType": "git"
                },
                {
                  "lessThan": "96ea081ed52bf077cad6d00153b6fba68e510767",
                  "status": "affected",
                  "version": "1611603537a4b88cec7993f32b70c03113801a46",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/linux/btf.h",
                "kernel/bpf/bpf_struct_ops.c",
                "kernel/bpf/btf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.9"
                },
                {
                  "lessThan": "6.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.13.*",
                  "status": "unaffected",
                  "version": "6.13.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.13",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13.2",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.14",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing\n\nThere is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n.\nIn particular, the report is on tcp_congestion_ops that has\na \"struct module *owner\" member.\n\nFor struct_ops that has a \"struct module *owner\" member,\nit can be extended either by the regular kernel module or\nby the bpf_struct_ops. bpf_try_module_get() will be used\nto do the refcounting and different refcount is done\nbased on the owner pointer. When CONFIG_MODULES=n,\nthe btf_id of the \"struct module\" is missing:\n\nWARN: resolve_btfids: unresolved symbol module\n\nThus, the bpf_try_module_get() cannot do the correct refcounting.\n\nNot all subsystem\u0027s struct_ops requires the \"struct module *owner\" member.\ne.g. the recent sched_ext_ops.\n\nThis patch is to disable bpf_struct_ops registration if\nthe struct_ops has the \"struct module *\" member and the\n\"struct module\" btf_id is missing. The btf_type_is_fwd() helper\nis moved to the btf.h header file for this test.\n\nThis has happened since the beginning of bpf_struct_ops which has gone\nthrough many changes. The Fixes tag is set to a recent commit that this\npatch can apply cleanly. Considering CONFIG_MODULES=n is not\ncommon and the age of the issue, targeting for bpf-next also."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The attack is driven entirely through local syscalls \u2014 bpf(BPF_MAP_CREATE/MAP_UPDATE_ELEM/LINK_CREATE) to register the struct_ops congestion control, setsockopt(TCP_CONGESTION) to bind a socket to it, and close() to drop the map. Although the freed object is subsequently dereferenced while processing TCP ACKs, a remote peer cannot perform the registration/free setup.\nAC:L - On an affected kernel every step is deterministic and attacker-driven \u2014 register the struct_ops, attach it to a socket the attacker owns, close the fds to free the map, then drive traffic over loopback to hit the dangling icsk_ca_ops; there is no race and no dependence on memory layout the attacker cannot influence. The build-time CONFIG_MODULES=n precondition defines the vulnerable configuration rather than a condition to be won at exploit time, and it is trivially observable in advance (absent /proc/modules).\nPR:L - Creating the struct_ops map goes through bpf_token_capable(token, CAP_BPF), which BPF tokens explicitly delegate into unprivileged container user namespaces \u2014 the model container runtimes and BPF agents routinely use \u2014 and the socket, setsockopt(TCP_CONGESTION) and loopback-traffic halves of the attack need no capability at all.\nUI:N - The attacker performs the entire sequence with its own process, sockets and file descriptors; no victim action, mount, or configuration change by another user is required.\nS:U - The dangling tcp_congestion_ops pointer is dereferenced by the same kernel the attacker already has local access to; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed st_map allocation holding kvalue.data can be reclaimed and shaped by the attacker while sockets still read through icsk_ca_ops, turning the stale pointer into a controlled kernel-memory read primitive that leaks arbitrary kernel data.\nI:H - The kernel makes indirect calls through function pointers in the freed tcp_congestion_ops and into freed trampoline/bpf_prog_pack executable pages, giving a direct control-flow hijack primitive after heap or exec-page reclaim \u2014 full arbitrary write and code execution in kernel context.\nA:H - Even unweaponized, the use-after-free causes an oops or panic on the next congestion-control callback, and installing the bpf CA as the netns default poisons every new TCP socket in that namespace, wedging the network stack."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:47:30.918Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b777b14c2a4a4e2322daf8e8ffd42d2b88831b17"
            },
            {
              "url": "https://git.kernel.org/stable/c/2324fb4e92092837ee278fdd8d60c48ee1a619ce"
            },
            {
              "url": "https://git.kernel.org/stable/c/96ea081ed52bf077cad6d00153b6fba68e510767"
            }
          ],
          "title": "bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-58060",
        "datePublished": "2025-03-06T15:54:03.253Z",
        "dateReserved": "2025-03-06T15:52:09.179Z",
        "dateUpdated": "2026-08-05T11:47:30.918Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.