PT-2024-33826 · Linux+5 · Linux Kernel+5
Kuan-Wei Chiu
·
Published
2024-10-21
·
Updated
2026-05-26
·
CVE-2024-49987
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.58
Description:
The issue arises from the
bpftool in the Linux kernel, where qsort is called with a NULL pointer when netfilter has no entry to display, resulting in undefined behavior. This is reported by UBSan as a runtime error due to a null pointer being passed as an argument. The C standard implies that passing invalid arguments, including null pointers, to functions leads to undefined behavior. To mitigate this, an early return is added when nf link info is NULL to prevent calling qsort with a NULL pointer.Recommendations:
For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider modifying the code to add an early return when
nf link info is NULL to prevent calling qsort with a NULL pointer.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu