CVE-2024-40908: bpf: Set run context for rawtp test_run callback
In the Linux kernel, the following vulnerability has been resolved:
bpf: Set run context for rawtp testrun callback
syzbot reported crash when rawtp program executed through the testrun interface calls bpfgetattachcookie helper or any other helper that touches task->bpfctx pointer.
Setting the run context (task->bpfctx pointer) for testrun callback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.99-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40908?
CVE-2024-40908 is classified as a high-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-40908?
To fix CVE-2024-40908, update your Linux kernel to one of the patched versions, such as 5.10.223-1, 6.1.123-1, or 6.12.12-1.
Which software versions are affected by CVE-2024-40908?
The affected versions include the Linux kernel versions prior to 5.10.223-1, 6.1.123-1, and 6.12.12-1.
What components are impacted by CVE-2024-40908?
CVE-2024-40908 impacts the BPF (Berkeley Packet Filter) functionality in the Linux kernel.
Is there a known exploit for CVE-2024-40908?
As of now, there are no publicly reported exploits specifically targeting CVE-2024-40908.