CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.3 | $0-$5k | 0.09 |
A vulnerability has been found in Linux Kernel up to 6.8.1 and classified as critical. Affected by this vulnerability is the function roundup_pow_of_two
of the component bpf. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem.
It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2024-26883 since 02/19/2024. The exploitation appears to be easy. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/17/2024).
Upgrading to version 4.19.311, 5.4.273, 5.10.214, 5.11, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2 or 6.9-rc1 eliminates this vulnerability. Applying the patch d0e214acc591/21e5fa4688e1/15641007df0f/ca1f06e72dec/f06899582cce/7070b274c786/43f798b90364/0971126c8164/7a4b21250bf7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.
Product
Type
Vendor
Name
Version
- 4.19.310
- 5.0
- 5.1
- 5.2
- 5.3
- 5.4
- 5.4.272
- 5.5
- 5.6
- 5.7
- 5.8
- 5.9
- 5.10
- 5.10.213
- 5.11
- 5.15.152
- 6.1.0
- 6.1.1
- 6.1.2
- 6.1.3
- 6.1.4
- 6.1.5
- 6.1.6
- 6.1.7
- 6.1.8
- 6.1.9
- 6.1.10
- 6.1.11
- 6.1.12
- 6.1.13
- 6.1.14
- 6.1.15
- 6.1.16
- 6.1.17
- 6.1.18
- 6.1.19
- 6.1.20
- 6.1.21
- 6.1.22
- 6.1.23
- 6.1.24
- 6.1.25
- 6.1.26
- 6.1.27
- 6.1.28
- 6.1.29
- 6.1.30
- 6.1.31
- 6.1.32
- 6.1.33
- 6.1.34
- 6.1.35
- 6.1.36
- 6.1.37
- 6.1.38
- 6.1.39
- 6.1.40
- 6.1.41
- 6.1.42
- 6.1.43
- 6.1.44
- 6.1.45
- 6.1.46
- 6.1.47
- 6.1.48
- 6.1.49
- 6.1.50
- 6.1.51
- 6.1.52
- 6.1.53
- 6.1.54
- 6.1.55
- 6.1.56
- 6.1.57
- 6.1.58
- 6.1.59
- 6.1.60
- 6.1.61
- 6.1.62
- 6.1.63
- 6.1.64
- 6.1.65
- 6.1.66
- 6.1.67
- 6.1.68
- 6.1.69
- 6.1.70
- 6.1.71
- 6.1.72
- 6.1.73
- 6.1.74
- 6.1.75
- 6.1.76
- 6.1.77
- 6.1.78
- 6.1.79
- 6.1.80
- 6.1.81
- 6.1.82
- 6.6.0
- 6.6.1
- 6.6.2
- 6.6.3
- 6.6.4
- 6.6.5
- 6.6.6
- 6.6.7
- 6.6.8
- 6.6.9
- 6.6.10
- 6.6.11
- 6.6.12
- 6.6.13
- 6.6.14
- 6.6.15
- 6.6.16
- 6.6.17
- 6.6.18
- 6.6.19
- 6.6.20
- 6.6.21
- 6.6.22
- 6.7.0
- 6.7.1
- 6.7.2
- 6.7.3
- 6.7.4
- 6.7.5
- 6.7.6
- 6.7.7
- 6.7.8
- 6.7.9
- 6.7.10
- 6.8.0
- 6.8.1
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.5VulDB Meta Temp Score: 5.3
VulDB Base Score: 5.5
VulDB Temp Score: 5.3
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Buffer overflowCWE: CWE-120 / CWE-119
CAPEC: 🔒
ATT&CK: 🔒
Local: No
Remote: Partially
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: Kernel 4.19.311/5.4.273/5.10.214/5.11/5.15.153/6.1.83/6.6.23/6.7.11/6.8.2/6.9-rc1
Patch: d0e214acc591/21e5fa4688e1/15641007df0f/ca1f06e72dec/f06899582cce/7070b274c786/43f798b90364/0971126c8164/7a4b21250bf7
Timeline
02/19/2024 CVE reserved04/17/2024 Advisory disclosed
04/17/2024 VulDB entry created
04/17/2024 VulDB entry last update
Sources
Vendor: kernel.orgAdvisory: git.kernel.org
Status: Confirmed
CVE: CVE-2024-26883 (🔒)
Entry
Created: 04/17/2024 13:23Changes: 04/17/2024 13:23 (58)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.