CVE-2024-40908
bpf: Set run context for rawtp test_run callback
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback syzbot reported crash when rawtp program executed through the test_run interface calls bpf_get_attach_cookie helper or any other helper that touches task->bpf_ctx pointer. Setting the run context (task->bpf_ctx pointer) for test_run callback.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/3708b6c2546c9eb34aead8a34a17e8ae69004e4d
- https://git.kernel.org/stable/c/789bd77c9342aa6125003871ae5c6034d0f6f9d2
- https://git.kernel.org/stable/c/ae0ba0ab7475a129ef7d449966edf677367efeb4
- https://git.kernel.org/stable/c/d0d1df8ba18abc57f28fb3bc053b2bf319367f2c
- https://git.kernel.org/stable/c/d387805d4b4a46ee01e3dae133c81b6d80195e5b
References (6)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.