GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47728 (GCVE-0-2024-47728)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-05-11 20:39
VLAI
Title
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error For all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input arguments, zero the value for the case of an error as otherwise it could leak memory. For tracing, it is not needed given CAP_PERFMON can already read all kernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped in here. Also, the MTU helpers mtu_len pointer value is being written but also read. Technically, the MEM_UNINIT should not be there in order to always force init. Removing MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now implies two things actually: i) write into memory, ii) memory does not have to be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory, ii) memory must be initialized. This means that for bpf_*_check_mtu() we're readding the issue we're trying to fix, that is, it would then be able to write back into things like .rodata BPF maps. Follow-up work will rework the MEM_UNINIT semantics such that the intent can be better expressed. For now just clear the *mtu_len on error path which can be lifted later again.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d7a4cb9b6705a89937d12c8158a35a3145dc967a , < 8397bf78988f3ae9dbebb0200189a62a57264980 (git)
Affected: d7a4cb9b6705a89937d12c8158a35a3145dc967a , < a634fa8e480ac2423f86311a602f6295df2c8ed0 (git)
Affected: d7a4cb9b6705a89937d12c8158a35a3145dc967a , < 599d15b6d03356a97bff7a76155c5604c42a2962 (git)
Affected: d7a4cb9b6705a89937d12c8158a35a3145dc967a , < 594a9f5a8d2de2573a856e506f77ba7dd2cefc6a (git)
Affected: d7a4cb9b6705a89937d12c8158a35a3145dc967a , < 4b3786a6c5397dc220b1483d8e2f4867743e966f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:00:53.440960Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:16.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:25.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c",
            "kernel/bpf/syscall.c",
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8397bf78988f3ae9dbebb0200189a62a57264980",
              "status": "affected",
              "version": "d7a4cb9b6705a89937d12c8158a35a3145dc967a",
              "versionType": "git"
            },
            {
              "lessThan": "a634fa8e480ac2423f86311a602f6295df2c8ed0",
              "status": "affected",
              "version": "d7a4cb9b6705a89937d12c8158a35a3145dc967a",
              "versionType": "git"
            },
            {
              "lessThan": "599d15b6d03356a97bff7a76155c5604c42a2962",
              "status": "affected",
              "version": "d7a4cb9b6705a89937d12c8158a35a3145dc967a",
              "versionType": "git"
            },
            {
              "lessThan": "594a9f5a8d2de2573a856e506f77ba7dd2cefc6a",
              "status": "affected",
              "version": "d7a4cb9b6705a89937d12c8158a35a3145dc967a",
              "versionType": "git"
            },
            {
              "lessThan": "4b3786a6c5397dc220b1483d8e2f4867743e966f",
              "status": "affected",
              "version": "d7a4cb9b6705a89937d12c8158a35a3145dc967a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c",
            "kernel/bpf/syscall.c",
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\n\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\narguments, zero the value for the case of an error as otherwise it could leak\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\nin here.\n\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\nTechnically, the MEM_UNINIT should not be there in order to always force init.\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\nimplies two things actually: i) write into memory, ii) memory does not have\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\nii) memory must be initialized. This means that for bpf_*_check_mtu() we\u0027re\nreadding the issue we\u0027re trying to fix, that is, it would then be able to\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\nMEM_UNINIT semantics such that the intent can be better expressed. For now\njust clear the *mtu_len on error path which can be lifted later again."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:39:35.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8397bf78988f3ae9dbebb0200189a62a57264980"
        },
        {
          "url": "https://git.kernel.org/stable/c/a634fa8e480ac2423f86311a602f6295df2c8ed0"
        },
        {
          "url": "https://git.kernel.org/stable/c/599d15b6d03356a97bff7a76155c5604c42a2962"
        },
        {
          "url": "https://git.kernel.org/stable/c/594a9f5a8d2de2573a856e506f77ba7dd2cefc6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b3786a6c5397dc220b1483d8e2f4867743e966f"
        }
      ],
      "title": "bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47728",
    "datePublished": "2024-10-21T12:14:01.012Z",
    "dateReserved": "2024-09-30T16:00:12.957Z",
    "dateUpdated": "2026-05-11T20:39:35.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47728",
      "date": "2026-09-16",
      "epss": "0.00236",
      "percentile": "0.14729"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.2\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"6C4FF0D1-B45B-4E3D-9E2A-F50C67CA711C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\\n\\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\\narguments, zero the value for the case of an error as otherwise it could leak\\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\\nin here.\\n\\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\\nTechnically, the MEM_UNINIT should not be there in order to always force init.\\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\\nimplies two things actually: i) write into memory, ii) memory does not have\\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\\nii) memory must be initialized. This means that for bpf_*_check_mtu() we\u0027re\\nreadding the issue we\u0027re trying to fix, that is, it would then be able to\\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\\nMEM_UNINIT semantics such that the intent can be better expressed. For now\\njust clear the *mtu_len on error path which can be lifted later again.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: cero antiguos argumentos ARG_PTR_TO_{LONG,INT} en caso de error Para todos los ayudantes que no son de seguimiento que anteriormente ten\\u00edan ARG_PTR_TO_{LONG,INT} como argumentos de entrada, ponga a cero el valor en caso de error, ya que de lo contrario podr\\u00eda perder memoria. Para el seguimiento, no es necesario dado que CAP_PERFMON ya puede leer toda la memoria del kernel de todos modos, por lo tanto, bpf_get_func_arg() y bpf_get_func_ret() se omiten aqu\\u00ed. Adem\\u00e1s, el valor del puntero mtu_len de los ayudantes de MTU se escribe pero tambi\\u00e9n se lee. T\\u00e9cnicamente, MEM_UNINIT no deber\\u00eda estar all\\u00ed para forzar siempre la inicializaci\\u00f3n. Sin embargo, eliminar MEM_UNINIT necesita m\\u00e1s reelaboraci\\u00f3n del verificador: MEM_UNINIT en este momento implica dos cosas en realidad: i) escribir en la memoria, ii) la memoria no tiene que ser inicializada. Si eliminamos MEM_UNINIT, se convierte en: i) lectura en memoria, ii) la memoria debe inicializarse. Esto significa que para bpf_*_check_mtu() estamos agregando nuevamente el problema que estamos tratando de solucionar, es decir, entonces podr\\u00eda volver a escribir en cosas como mapas BPF .rodata. El trabajo de seguimiento reelaborar\\u00e1 la sem\\u00e1ntica de MEM_UNINIT de modo que la intenci\\u00f3n pueda expresarse mejor. Por ahora, simplemente borre *mtu_len en la ruta de error que se puede eliminar nuevamente m\\u00e1s tarde.\"}]",
      "id": "CVE-2024-47728",
      "lastModified": "2024-10-23T20:36:52.367",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T13:15:02.980",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4b3786a6c5397dc220b1483d8e2f4867743e966f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/594a9f5a8d2de2573a856e506f77ba7dd2cefc6a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/599d15b6d03356a97bff7a76155c5604c42a2962\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8397bf78988f3ae9dbebb0200189a62a57264980\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a634fa8e480ac2423f86311a602f6295df2c8ed0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-459\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47728\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:02.980\",\"lastModified\":\"2026-06-17T07:57:38.320\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\\n\\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\\narguments, zero the value for the case of an error as otherwise it could leak\\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\\nin here.\\n\\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\\nTechnically, the MEM_UNINIT should not be there in order to always force init.\\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\\nimplies two things actually: i) write into memory, ii) memory does not have\\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\\nii) memory must be initialized. This means that for bpf_*_check_mtu() we\u0027re\\nreadding the issue we\u0027re trying to fix, that is, it would then be able to\\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\\nMEM_UNINIT semantics such that the intent can be better expressed. For now\\njust clear the *mtu_len on error path which can be lifted later again.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: cero antiguos argumentos ARG_PTR_TO_{LONG,INT} en caso de error Para todos los ayudantes que no son de seguimiento que anteriormente ten\u00edan ARG_PTR_TO_{LONG,INT} como argumentos de entrada, ponga a cero el valor en caso de error, ya que de lo contrario podr\u00eda perder memoria. Para el seguimiento, no es necesario dado que CAP_PERFMON ya puede leer toda la memoria del kernel de todos modos, por lo tanto, bpf_get_func_arg() y bpf_get_func_ret() se omiten aqu\u00ed. Adem\u00e1s, el valor del puntero mtu_len de los ayudantes de MTU se escribe pero tambi\u00e9n se lee. T\u00e9cnicamente, MEM_UNINIT no deber\u00eda estar all\u00ed para forzar siempre la inicializaci\u00f3n. Sin embargo, eliminar MEM_UNINIT necesita m\u00e1s reelaboraci\u00f3n del verificador: MEM_UNINIT en este momento implica dos cosas en realidad: i) escribir en la memoria, ii) la memoria no tiene que ser inicializada. Si eliminamos MEM_UNINIT, se convierte en: i) lectura en memoria, ii) la memoria debe inicializarse. Esto significa que para bpf_*_check_mtu() estamos agregando nuevamente el problema que estamos tratando de solucionar, es decir, entonces podr\u00eda volver a escribir en cosas como mapas BPF .rodata. El trabajo de seguimiento reelaborar\u00e1 la sem\u00e1ntica de MEM_UNINIT de modo que la intenci\u00f3n pueda expresarse mejor. Por ahora, simplemente borre *mtu_len en la ruta de error que se puede eliminar nuevamente m\u00e1s tarde.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/helpers.c\",\"kernel/bpf/syscall.c\",\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7a4cb9b6705a89937d12c8158a35a3145dc967a\",\"lessThan\":\"8397bf78988f3ae9dbebb0200189a62a57264980\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7a4cb9b6705a89937d12c8158a35a3145dc967a\",\"lessThan\":\"a634fa8e480ac2423f86311a602f6295df2c8ed0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7a4cb9b6705a89937d12c8158a35a3145dc967a\",\"lessThan\":\"599d15b6d03356a97bff7a76155c5604c42a2962\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7a4cb9b6705a89937d12c8158a35a3145dc967a\",\"lessThan\":\"594a9f5a8d2de2573a856e506f77ba7dd2cefc6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7a4cb9b6705a89937d12c8158a35a3145dc967a\",\"lessThan\":\"4b3786a6c5397dc220b1483d8e2f4867743e966f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/helpers.c\",\"kernel/bpf/syscall.c\",\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:00:53.440960Z\",\"id\":\"CVE-2024-47728\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"6C4FF0D1-B45B-4E3D-9E2A-F50C67CA711C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4b3786a6c5397dc220b1483d8e2f4867743e966f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/594a9f5a8d2de2573a856e506f77ba7dd2cefc6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/599d15b6d03356a97bff7a76155c5604c42a2962\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8397bf78988f3ae9dbebb0200189a62a57264980\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a634fa8e480ac2423f86311a602f6295df2c8ed0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:14:07+00:00",
      "cve": "CVE-2024-47728",
      "id": "CVE-2024-47728",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47728.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:58:02Z",
      "cve": "CVE-2024-47728",
      "id": "CVE-2024-47728",
      "initial_release_date": "2024-10-21T15:46:47Z",
      "product_status:known_affected": "387",
      "product_status:known_not_affected": "237",
      "product_status:recommended": "636",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47728",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47728.json",
      "version": "88"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:25.047Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47728\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:00:53.440960Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:00:57.615Z\"}}], \"cna\": {\"title\": \"bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d7a4cb9b6705a89937d12c8158a35a3145dc967a\", \"lessThan\": \"8397bf78988f3ae9dbebb0200189a62a57264980\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7a4cb9b6705a89937d12c8158a35a3145dc967a\", \"lessThan\": \"a634fa8e480ac2423f86311a602f6295df2c8ed0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7a4cb9b6705a89937d12c8158a35a3145dc967a\", \"lessThan\": \"599d15b6d03356a97bff7a76155c5604c42a2962\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7a4cb9b6705a89937d12c8158a35a3145dc967a\", \"lessThan\": \"594a9f5a8d2de2573a856e506f77ba7dd2cefc6a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7a4cb9b6705a89937d12c8158a35a3145dc967a\", \"lessThan\": \"4b3786a6c5397dc220b1483d8e2f4867743e966f\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/helpers.c\", \"kernel/bpf/syscall.c\", \"net/core/filter.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/helpers.c\", \"kernel/bpf/syscall.c\", \"net/core/filter.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8397bf78988f3ae9dbebb0200189a62a57264980\"}, {\"url\": \"https://git.kernel.org/stable/c/a634fa8e480ac2423f86311a602f6295df2c8ed0\"}, {\"url\": \"https://git.kernel.org/stable/c/599d15b6d03356a97bff7a76155c5604c42a2962\"}, {\"url\": \"https://git.kernel.org/stable/c/594a9f5a8d2de2573a856e506f77ba7dd2cefc6a\"}, {\"url\": \"https://git.kernel.org/stable/c/4b3786a6c5397dc220b1483d8e2f4867743e966f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\\n\\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\\narguments, zero the value for the case of an error as otherwise it could leak\\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\\nin here.\\n\\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\\nTechnically, the MEM_UNINIT should not be there in order to always force init.\\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\\nimplies two things actually: i) write into memory, ii) memory does not have\\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\\nii) memory must be initialized. This means that for bpf_*_check_mtu() we\u0027re\\nreadding the issue we\u0027re trying to fix, that is, it would then be able to\\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\\nMEM_UNINIT semantics such that the intent can be better expressed. For now\\njust clear the *mtu_len on error path which can be lifted later again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:38:23.854Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47728\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:21:25.047Z\", \"dateReserved\": \"2024-09-30T16:00:12.957Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:01.012Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.