CVE-2024-43837: bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT
bpf: Fix null pointer dereference in resolveprogtype() for BPFPROGTYPEEXT
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.106-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.10.3-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Update resolve_prog_type() to return prog->type for BPF_PROG_TYPE_EXT when prog->aux->dst_prog is null or not present, preventing the null pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43837?
The severity of CVE-2024-43837 has not been explicitly stated, but it involves a null pointer dereference which can lead to potential crashes in the kernel.
How do I fix CVE-2024-43837?
To fix CVE-2024-43837, upgrade to the recommended kernel versions that address this vulnerability, such as linux 5.10.223-1, 5.10.226-1, or 6.12.12-1.
What versions of the Linux kernel are affected by CVE-2024-43837?
CVE-2024-43837 affects multiple versions of the Linux kernel ranging from 5.18 to 6.6.44, including specific builds within those ranges.
Is CVE-2024-43837 a critical vulnerability?
While CVE-2024-43837 is not classified as critical, it poses risks due to potential crashes from null pointer dereference in the kernel.
What should I do if I can't immediately upgrade to address CVE-2024-43837?
If you cannot upgrade immediately, ensure that your system is monitored closely for unusual behavior and be prepared to patch as soon as possible.