CVE-2024-50164

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an issue in the BPF verifier where check_mem_size_reg() has the following code: if (!tnum_is_const(reg->var_off)) /* For unprivileged variable accesses, disable raw * mode so that the program is required to * initialize all the memory that the helper could * just partially fill up. */ meta = NULL; This means that writes are not checked when the register containing the size of the passed buffer has not a fixed size. Through this bug, a BPF program can write to a ma...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 97e6d7dab1ca4648821c790a2b7913d6d5d549db < 43f4df339a4d375bedcad29a61ae6f0ee7a048f8, >= 97e6d7dab1ca4648821c790a2b7913d6d5d549db < 48068ccaea957469f1adf78dfd2c1c9a7e18f0fe, >= 97e6d7dab1ca4648821c790a2b7913d6d5d549db < 54bc31682660810af1bed7ca7a19f182df8d3df8, >= 97e6d7dab1ca4648821c790a2b7913d6d5d549db < 8ea607330a39184f51737c6ae706db7fdca7628e, >= 6099a6c8a749a5c8d5f8b4c4342022a92072a02b, >= bfe25df63048edd4ceaf78a2fc755d5e2befc978, >= 717c39718dbc4f7ebcbb7b625fb11851cd9007fe, >= 5d0bba8232bf22ce13747cbfc8f696318ff01a50, >= 70674d11d14eeecad90be4b409a22b902112ba32, >= a08d942ecbf46e23a192093f6983cb1d779f4fa8, >= 5.15.45 < 5.16, >= 5.17.13 < 5.18, >= 5.18.2 < 5.19, >= 5.19, >= V3.1.6, >= 5.19 < 6.6.59, >= 6.7 < 6.11.6, 6.12

Fixed versions

6.6.59, 6.11.6

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

Not available