PT-2024-5410 · Linux+4 · Linux Kernel+4
Published
2024-05-27
·
Updated
2025-09-29
·
CVE-2024-36481
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The issue is related to the function
parse btf field() in the Linux kernel's tracing subsystem. The problem arises from the incorrect checking of the return code of the btf find struct member() function, which may return NULL or an error via the ERR PTR() macro. However, its caller in parse btf field() only checks for the NULL condition, potentially leading to an error. The fix involves using IS ERR() and returning the error up the stack. This could allow an attacker to cause a denial of service.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider restricting access to the tracing subsystem to minimize the risk of exploitation.
Exploit
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Ubuntu