CVE-2024-50203: bpf, arm64: Fix address emission with tag-based KASAN enabled
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix address emission with tag-based KASAN enabled
When BPFTRAMPFCALLORIG is enabled, the address of a bpftrampimage struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emita64movi64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpftrampimage address emission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50203?
CVE-2024-50203 has not been assigned a specific severity rating, but it impacts various versions of the Linux kernel.
How do I fix CVE-2024-50203?
To resolve CVE-2024-50203, users should upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50203?
CVE-2024-50203 affects Linux kernel versions from 6.10.3 to 6.11, as well as specific release candidates of version 6.12.
What kind of vulnerability is CVE-2024-50203?
CVE-2024-50203 is a vulnerability in the Linux kernel's BPF subsystem related to address emission when tag-based KASAN is enabled.
Is CVE-2024-50203 exploitable in a production environment?
The exploitability of CVE-2024-50203 in a production environment depends on the specific use case and configuration of the affected kernel versions.