CVE-2024-26885

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned...

Affected product and versions

Product

Linux Linux, linux_kernel, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Affected versions

>= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < 1f5e352b9088211fa5eb4e1639cd365f4f7d2f65, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < 4b81a9f92b3676cb74b907a7a209b3d15bd9a7f9, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < c826502bed93970f2fd488918a7b8d5f1d30e2e3, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < edf7990baa48de5097daa9ac02e06cb4c798a737, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < 250051acc21f9d4c5c595e4fcb55986ea08c4691, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < 22079b3a423382335f47d9ed32114e6c9fe88d7c, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < e89386f62ce9a9ab9a94835a9890883c23d9d52c, >= 6f9d451ab1a33728adb72d7ff66a7b374d665176 < 281d464a34f540de166cee74b723e97ac2515ec3, >= 5.4, >= 6f9d451ab1a3, >= 5.4 < 5.10.214, >= 5.11 < 5.15.153, >= 5.16 < 6.1.83, >= 6.2 < 6.6.23, >= 6.7 < 6.7.11, >= 6.8 < 6.8.2

Fixed versions

5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-119