cve-2024-36918
Vulnerability from cvelistv5
Published
2024-05-30 15:29
Modified
2024-12-19 09:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3
Impacted products
Vendor Product Version
Linux Linux Version: 5.16
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36918",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:16:07.190878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:35:00.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bloom_filter.c",
            "tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa6995eeb62e74b5a1480c73fb7b420c270784d3",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "608e13706c8b6c658a0646f09ebced74ec367f7c",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "c418afb9bf23e2f2b76cb819601e4a5d9dbab42d",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "a8d89feba7e54e691ca7c4efc2a6264fa83f3687",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bloom_filter.c",
            "tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check bloom filter map value size\n\nThis patch adds a missing check to bloom filter creating, rejecting\nvalues above KMALLOC_MAX_SIZE. This brings the bloom map in line with\nmany other map types.\n\nThe lack of this protection can cause kernel crashes for value sizes\nthat overflow int\u0027s. Such a crash was caught by syzkaller. The next\npatch adds more guard-rails at a lower level."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:02:04.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687"
        }
      ],
      "title": "bpf: Check bloom filter map value size",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36918",
    "datePublished": "2024-05-30T15:29:13.904Z",
    "dateReserved": "2024-05-30T15:25:07.068Z",
    "dateUpdated": "2024-12-19T09:02:04.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36918\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:15.130\",\"lastModified\":\"2024-11-21T09:22:48.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check bloom filter map value size\\n\\nThis patch adds a missing check to bloom filter creating, rejecting\\nvalues above KMALLOC_MAX_SIZE. This brings the bloom map in line with\\nmany other map types.\\n\\nThe lack of this protection can cause kernel crashes for value sizes\\nthat overflow int\u0027s. Such a crash was caught by syzkaller. The next\\npatch adds more guard-rails at a lower level.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: Verificar el tama\u00f1o del valor del mapa del filtro de floraci\u00f3n. Este parche agrega una verificaci\u00f3n faltante para la creaci\u00f3n del filtro de floraci\u00f3n, rechazando valores superiores a KMALLOC_MAX_SIZE. Esto alinea el mapa de floraci\u00f3n con muchos otros tipos de mapas. La falta de esta protecci\u00f3n puede provocar fallas del kernel para tama\u00f1os de valores que desbordan los de int. Syzkaller capt\u00f3 tal accidente. El siguiente parche agrega m\u00e1s barandillas en un nivel inferior.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.