UBUNTU-CVE-2024-56615: High severity ubuntu/linux-azure vulnerability

Published Dec 27, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via devmapfree(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: errorcode(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: eventsunbound bpfmapfreedeferred [ 160.773308] RIP: 0010:devmapfree+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? die+0x20/0x60 [ 160.884586] ? pagefaultoops+0x15a/0x450 [ 160.888746] ? searchextable+0x22/0x30 [ 160.892647] ? searchbpfextables+0x5f/0x80 [ 160.896988] ? excpagefault+0xa9/0x140 [ 160.900973] ? asmexcpagefault+0x22/0x30 [ 160.905232] ? devmapfree+0x77/0x170 [ 160.909043] ? devmapfree+0x58/0x170 [ 160.912857] bpfmapfreedeferred+0x51/0x90 [ 160.917196] processonework+0x142/0x370 [ 160.921272] workerthread+0x29e/0x3b0 [ 160.925082] ? rescuerthread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthreadpark+0x80/0x80 [ 160.936079] retfromfork+0x2d/0x50 [ 160.943396] ? kthreadpark+0x80/0x80 [ 160.950803] retfromforkasm+0x11/0x20 [ 160.958482] </TASK>

Affected Software

197 affected componentsFixes available
ubuntu/linux-azure<4.15.0-1187.202~14.04.1
4.15.0-1187.202~14.04.1
ubuntu/linux-aws-hwe<4.15.0-1179.192~16.04.1
4.15.0-1179.192~16.04.1
ubuntu/linux-azure<4.15.0-1187.202~16.04.1
4.15.0-1187.202~16.04.1
ubuntu/linux-gcp<4.15.0-1172.189~16.04.1
4.15.0-1172.189~16.04.1
ubuntu/linux-hwe<4.15.0-236.248~16.04.1
4.15.0-236.248~16.04.1
ubuntu/linux-oracle<4.15.0-1141.152~16.04.1
4.15.0-1141.152~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux<4.15.0-236.248
4.15.0-236.248
ubuntu/linux-aws<4.15.0-1179.192
4.15.0-1179.192
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1142.152~18.04.1
5.4.0-1142.152~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15<4.15.0-1187.202
4.15.0-1187.202
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1147.154~18.04.1
5.4.0-1147.154~18.04.1
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15<4.15.0-1172.189
4.15.0-1172.189
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1145.154~18.04.1
5.4.0-1145.154~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-211.231~18.04.1
5.4.0-211.231~18.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1090.95~18.04.1
5.4.0-1090.95~18.04.1
ubuntu/linux-kvm<4.15.0-1162.167
4.15.0-1162.167
ubuntu/linux-oem*
ubuntu/linux-oracle<4.15.0-1141.152
4.15.0-1141.152
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1140.149~18.04.1
5.4.0-1140.149~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1129.142~18.04.1
5.4.0-1129.142~18.04.1
ubuntu/linux-aws-fips<4.15.0-2117.123
4.15.0-2117.123
ubuntu/linux-azure-fips<4.15.0-2096.102
4.15.0-2096.102
ubuntu/linux-fips<4.15.0-1134.145
4.15.0-1134.145
ubuntu/linux-gcp-fips<4.15.0-2080.86
4.15.0-2080.86
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-211.231
5.4.0-211.231
ubuntu/linux-aws<5.4.0-1142.152
5.4.0-1142.152
ubuntu/linux-aws-5.15<5.15.0-1080.87~20.04.1
5.15.0-1080.87~20.04.1
ubuntu/linux-azure<5.4.0-1147.154
5.4.0-1147.154
ubuntu/linux-azure-5.15<5.15.0-1086.95~20.04.1
5.15.0-1086.95~20.04.1
ubuntu/linux-bluefield<5.4.0-1101.108
5.4.0-1101.108
ubuntu/linux-gcp<5.4.0-1145.154
5.4.0-1145.154
ubuntu/linux-gcp-5.15<5.15.0-1081.90~20.04.1
5.15.0-1081.90~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-136.147~20.04.1
5.15.0-136.147~20.04.1
ubuntu/linux-ibm<5.4.0-1088.93
5.4.0-1088.93
ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1
5.15.0-1074.77~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1077.83~20.04.1
5.15.0-1077.83~20.04.1
ubuntu/linux-iot<5.4.0-1048.51
5.4.0-1048.51
ubuntu/linux-kvm<5.4.0-1129.138
5.4.0-1129.138
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-135.146~20.04.1
5.15.0-135.146~20.04.1
ubuntu/linux-oracle<5.4.0-1140.150
5.4.0-1140.150
ubuntu/linux-oracle-5.15<5.15.0-1077.83~20.04.1
5.15.0-1077.83~20.04.1
ubuntu/linux-raspi<5.4.0-1129.142
5.4.0-1129.142
ubuntu/linux-riscv-5.15<5.15.0-1075.79~20.04.1
5.15.0-1075.79~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1060.64
5.4.0-1060.64
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1
5.15.0-1039.39~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1142.153+fips1
5.4.0-1142.153+fips1
ubuntu/linux-azure-fips<5.4.0-1147.154+fips1
5.4.0-1147.154+fips1
ubuntu/linux-fips<5.4.0-1116.126
5.4.0-1116.126
ubuntu/linux-gcp-fips<5.4.0-1145.154+fips1
5.4.0-1145.154+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-135.146
5.15.0-135.146
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1080.87
5.15.0-1080.87
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1027.29~22.04.1
6.8.0-1027.29~22.04.1
ubuntu/linux-azure<5.15.0-1084.93
5.15.0-1084.93
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1027.32~22.04.1
6.8.0-1027.32~22.04.1
ubuntu/linux-azure-fde<5.15.0-1084.93.1
5.15.0-1084.93.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1079.88
5.15.0-1079.88
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1028.30~22.04.1
6.8.0-1028.30~22.04.1
ubuntu/linux-gke<5.15.0-1077.83
5.15.0-1077.83
ubuntu/linux-gkeop<5.15.0-1062.70
5.15.0-1062.70
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-58.60~22.04.1
6.8.0-58.60~22.04.1
ubuntu/linux-ibm<5.15.0-1072.75
5.15.0-1072.75
ubuntu/linux-ibm-6.8<6.8.0-1024.24~22.04.1
6.8.0-1024.24~22.04.1
ubuntu/linux-intel-iot-realtime<5.15.0-1073.75
5.15.0-1073.75
ubuntu/linux-intel-iotg<5.15.0-1075.81
5.15.0-1075.81
ubuntu/linux-kvm<5.15.0-1076.81
5.15.0-1076.81
ubuntu/linux-lowlatency<5.15.0-135.146
5.15.0-135.146
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-58.60.1~22.04.1
6.8.0-58.60.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1074.75
5.15.0-1074.75
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1026.29~22.04.1
6.8.0-1026.29~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1033.33
5.15.0-1033.33
ubuntu/linux-nvidia-tegra-igx<5.15.0-1021.21
5.15.0-1021.21
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1077.83
5.15.0-1077.83
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1024.25~22.04.1
6.8.0-1024.25~22.04.1
ubuntu/linux-raspi<5.15.0-1074.77
5.15.0-1074.77
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-58.60.1~22.04.1
6.8.0-58.60.1~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1044.48
5.15.0-1044.48
ubuntu/linux-bluefield<5.15.0-1062.64
5.15.0-1062.64
ubuntu/linux-realtime<5.15.0-1080.88
5.15.0-1080.88
ubuntu/linux-realtime-6.8<6.8.1-1020.21~22.04.1
6.8.1-1020.21~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1080.87+fips1
5.15.0-1080.87+fips1
ubuntu/linux-azure-fips<5.15.0-1083.92+fips1
5.15.0-1083.92+fips1
ubuntu/linux-fips<5.15.0-135.146+fips1
5.15.0-135.146+fips1
ubuntu/linux-gcp-fips<5.15.0-1079.88+fips1
5.15.0-1079.88+fips1
ubuntu/linux<6.8.0-58.60
6.8.0-58.60
ubuntu/linux-aws<6.8.0-1027.29
6.8.0-1027.29
ubuntu/linux-azure<6.8.0-1027.32
6.8.0-1027.32
ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1
6.11.0-1012.12~24.04.1
ubuntu/linux-azure-nvidia<6.8.0-1014.15
6.8.0-1014.15
ubuntu/linux-gcp<6.8.0-1028.30
6.8.0-1028.30
ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1
6.11.0-1011.11~24.04.1
ubuntu/linux-gke<6.8.0-1023.27
6.8.0-1023.27
ubuntu/linux-gkeop<6.8.0-1010.12
6.8.0-1010.12
ubuntu/linux-hwe-6.11<6.11.0-21.21~24.04.1
6.11.0-21.21~24.04.1
ubuntu/linux-ibm<6.8.0-1024.24
6.8.0-1024.24
ubuntu/linux-lowlatency<6.8.0-58.60.1
6.8.0-58.60.1
ubuntu/linux-nvidia<6.8.0-1026.29
6.8.0-1026.29
ubuntu/linux-nvidia-6.11<6.11.0-1007.7
6.11.0-1007.7
ubuntu/linux-nvidia-lowlatency<6.8.0-1026.29.1
6.8.0-1026.29.1
ubuntu/linux-nvidia-tegra<6.8.0-1008.8
6.8.0-1008.8
ubuntu/linux-oem-6.11<6.11.0-1017.17
6.11.0-1017.17
ubuntu/linux-oem-6.8<6.8.0-1026.26
6.8.0-1026.26
ubuntu/linux-oracle<6.8.0-1024.25
6.8.0-1024.25
ubuntu/linux-raspi<6.8.0-1028.32
6.8.0-1028.32
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv<6.8.0-58.60.1
6.8.0-58.60.1
ubuntu/linux-xilinx<6.8.0-1017.18
6.8.0-1017.18
ubuntu/linux-raspi-realtime<6.8.0-2023.24
6.8.0-2023.24
ubuntu/linux-realtime<6.8.1-1020.21
6.8.1-1020.21
ubuntu/linux-fips<6.8.0-78.78+fips1
6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1187.202~14.04.1
  2. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1179.192~16.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1187.202~16.04.1
  4. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1172.189~16.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-236.248~16.04.1
  6. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1141.152~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-236.248
  8. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1179.192
  9. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.152~18.04.1
  10. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1187.202
  11. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154~18.04.1
  12. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1172.189
  13. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154~18.04.1
  14. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-211.231~18.04.1
  15. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1090.95~18.04.1
  16. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1162.167
  17. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1141.152
  18. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.149~18.04.1
  19. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2117.123
  21. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2096.102
  22. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1134.145
  23. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2080.86
  24. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-211.231
  25. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.152
  26. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87~20.04.1
  27. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154
  28. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1086.95~20.04.1
  29. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1101.108
  30. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154
  31. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1081.90~20.04.1
  32. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-136.147~20.04.1
  33. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1088.93
  34. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.77~20.04.1
  35. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83~20.04.1
  36. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1048.51
  37. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.138
  38. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146~20.04.1
  39. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.150
  40. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83~20.04.1
  41. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142
  42. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.79~20.04.1
  43. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.64
  44. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.39~20.04.1
  45. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.153+fips1
  46. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154+fips1
  47. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1116.126
  48. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154+fips1
  49. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146
  50. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87
  51. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1027.29~22.04.1
  52. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1084.93
  53. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1027.32~22.04.1
  54. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1084.93.1
  55. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1079.88
  56. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.30~22.04.1
  57. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83
  58. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.70
  59. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60~22.04.1
  60. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1072.75
  61. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.24~22.04.1
  62. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1073.75
  63. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.81
  64. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1076.81
  65. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146
  66. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60.1~22.04.1
  67. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.75
  68. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.29~22.04.1
  69. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.33
  70. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1021.21
  71. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83
  72. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.25~22.04.1
  73. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.77
  74. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60.1~22.04.1
  75. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1044.48
  76. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.64
  77. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.88
  78. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1020.21~22.04.1
  79. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87+fips1
  80. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1083.92+fips1
  81. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146+fips1
  82. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1079.88+fips1
  83. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60
  84. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1027.29
  85. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1027.32
  86. Upgrade

    Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1012.12~24.04.1
  87. Upgrade

    Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1014.15
  88. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.30
  89. Upgrade

    Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1011.11~24.04.1
  90. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1023.27
  91. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1010.12
  92. Upgrade

    Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-21.21~24.04.1
  93. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.24
  94. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60.1
  95. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.29
  96. Upgrade

    Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1007.7
  97. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.29.1
  98. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
  99. Upgrade

    Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1017.17
  100. Upgrade

    Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.26
  101. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.25
  102. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.32
  103. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.8.0-58.60.1
  104. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.18
  105. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2023.24
  106. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1020.21
  107. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-78.78+fips1
  108. Configuration

    Change the signed int types used for accessing DEVMAP entries and for the iterator in dev_map_free() to u32 to prevent out-of-bounds accesses.

    Linux kernel BPF DEVMAP DEVMAP index and dev_map_free iterator types = u32

Event History

Dec 27, 2024
CVE Published
via OSV·03:15 PM
Data Sourced
via OSV·03:15 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What level of access is required to exploit this issue?

The vulnerability is locally exploitable and requires high privileges. The issue involves BPF DEVMAP element deletion and cleanup paths.

2

Which Ubuntu kernel package variants are affected?

The affected software list includes ubuntu/linux, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-oracle.

3

What evidence might indicate that a system has encountered this condition?

Kernel logs may show an Oops or supervisor-mode page fault involving dev_map_free, potentially from the bpf_map_free_deferred workqueue. The provided example also reports an out-of-bounds access during DEVMAP cleanup.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203