PT-2024-26181 · Linux+5 · Linux Kernel+5

Published 2024-05-04 · Updated 2025-02-03 · CVE-2024-34777

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The issue arises from the validation of node ids in the map benchmark ioctl() function, where node possible() may be provided with an invalid argument outside of the [0,MAX NUMNODES-1] range. This leads to a wild-memory-access bug. The NUMA NO NODE is considered a special valid case, meaning benchmarking kthreads won't be bound to a cpuset of a given node. The vulnerability was found by the Linux Verification Center.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the map benchmark ioctl() function until a patch is available.

Exploit

Fix

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

BDU:2025-03916

CVE-2024-34777

MGASA-2024-0263

MGASA-2024-0266

OESA-2024-1941

OESA-2024-1942

OESA-2024-2028

OESA-2024-2076

SUSE-SU-2024:2571-1

SUSE-SU-2024:2896-1

SUSE-SU-2024:2973-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

USN-6999-1

USN-6999-2

USN-7004-1

USN-7005-1

USN-7005-2

USN-7007-1

USN-7007-2

USN-7007-3

USN-7008-1

USN-7009-1

USN-7009-2

USN-7019-1

USN-7029-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 2714

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34777.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2024-34777 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26999 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27412 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39504 · Security Note
• https://ubuntu.com/security/CVE-2024-38780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41087 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41087 · Security Note
• https://osv.dev/vulnerability/USN-7029-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1ff05e723f7ca30644b8ec3fb093f16312e408ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41054 · Security Note