PT-2024-34038 · Linux+4 · Linux Kernel+4
Published
2024-10-21
·
Updated
2025-11-11
·
CVE-2024-50203
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
A heap buffer overflow issue has been resolved in the Linux kernel. The problem occurs when BPF TRAMP F CALL ORIG is enabled, and the address of a bpf tramp image struct on the stack is passed during the size calculation pass, while an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit a64 mov i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. The issue is fixed by assuming the worst case when calculating the size of the bpf tramp image address emission.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Suse
Ubuntu