PT-2024-8406 · Linux+5 · Linux Kernel+5
Kui-Feng Lee
·
Published
2024-03-19
·
Updated
2025-02-03
·
CVE-2024-35917
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a NULL pointer dereference in the s390/bpf component of the Linux kernel. This is caused by the GCC compiler moving a memcpy() call after assignments in the bpf jit plt() function, resulting in NULL pointers being written instead of the return and target addresses. The problem arises due to a violation of the C standard, where two pointers are subtracted but do not point to elements of the same array object or one past the last element of the array object. This confusion in the GCC's alias analysis leads to the NULL pointer dereference. The vulnerability can be exploited to cause a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu