CVE-2024-36918 (GCVE-0-2024-36918)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:32
VLAI
Title
bpf: Check bloom filter map value size
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9330986c03006ab1d33d243b7cfe598a7a3c1baa , < fa6995eeb62e74b5a1480c73fb7b420c270784d3 (git)
Affected: 9330986c03006ab1d33d243b7cfe598a7a3c1baa , < 608e13706c8b6c658a0646f09ebced74ec367f7c (git)
Affected: 9330986c03006ab1d33d243b7cfe598a7a3c1baa , < c418afb9bf23e2f2b76cb819601e4a5d9dbab42d (git)
Affected: 9330986c03006ab1d33d243b7cfe598a7a3c1baa , < a8d89feba7e54e691ca7c4efc2a6264fa83f3687 (git)
Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36918",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:16:07.190878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:35:00.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bloom_filter.c",
            "tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa6995eeb62e74b5a1480c73fb7b420c270784d3",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "608e13706c8b6c658a0646f09ebced74ec367f7c",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "c418afb9bf23e2f2b76cb819601e4a5d9dbab42d",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            },
            {
              "lessThan": "a8d89feba7e54e691ca7c4efc2a6264fa83f3687",
              "status": "affected",
              "version": "9330986c03006ab1d33d243b7cfe598a7a3c1baa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bloom_filter.c",
            "tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check bloom filter map value size\n\nThis patch adds a missing check to bloom filter creating, rejecting\nvalues above KMALLOC_MAX_SIZE. This brings the bloom map in line with\nmany other map types.\n\nThe lack of this protection can cause kernel crashes for value sizes\nthat overflow int\u0027s. Such a crash was caught by syzkaller. The next\npatch adds more guard-rails at a lower level."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached purely through the `bpf()` syscall \u2014 `BPF_MAP_CREATE` for a bloom-filter map with an oversized `value_size`, then `BPF_PROG_LOAD` of a program calling `bpf_map_push_elem()` on it. No network or remote-peer input is involved.\nAC:L - Triggering is fully deterministic and attacker-controlled: pick any `value_size \u003e= 0x80000000` and any negative stack offset, and the signed overflow in `max_off + access_size` fires every time. There is no race, no timing window, and no memory-layout precondition needed to reach the out-of-bounds loop.\nPR:L - `bpf_map_push_elem` is in the unprivileged section of `bpf_base_func_proto()`, and bloom-filter map creation has no per-map-type capability gate at all on 5.16\u20136.3 (only `sysctl_unprivileged_bpf_disabled`), while on 6.9 a delegated bpffs BPF token grants `ns_capable(userns, CAP_BPF)` to an unprivileged containerized process. CAP_BPF is a deliberately reduced, non-root privilege routinely held by ordinary service accounts, so a basic low-privileged local context suffices.\nUI:N - The attacker performs the entire sequence \u2014 map creation plus program load \u2014 from their own process. No other user or administrator has to do anything.\nS:U - The corruption occurs in kernel heap memory belonging to the BPF verifier, within the same security authority as the exploiting process. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The loop performs unbounded negative-index reads of `state-\u003estack[spi].slot_type[]` and `spilled_ptr`, and `mark_reg_read()` chases an out-of-bounds `parent` pointer, giving an out-of-bounds kernel-heap read primitive that a heap-groomed attacker can leverage for arbitrary memory disclosure.\nI:H - With `clobber = true` the loop writes `*stype = STACK_MISC` out of bounds, `__mark_reg_unknown()`/`scrub_spilled_slot()` write a full `bpf_reg_state` and 8-byte slots out of bounds, and `mark_reg_read()` ORs `REG_LIVE_READ64` into an attacker-influenced wild pointer \u2014 an out-of-bounds write usable for control-flow hijacking.\nA:H - The overflowed loop iterates roughly two billion times descending ~120 bytes per 8 iterations, so it walks tens of gigabytes below the `stack` allocation and reliably faults on unmapped memory, producing a kernel oops/panic that any local user with map-create access can trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:03.979Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687"
        }
      ],
      "title": "bpf: Check bloom filter map value size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36918",
    "datePublished": "2024-05-30T15:29:13.904Z",
    "dateReserved": "2024-05-30T15:25:07.068Z",
    "dateUpdated": "2026-08-05T11:32:03.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36918",
      "date": "2026-08-07",
      "epss": "0.00234",
      "percentile": "0.1432"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36918\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:15.130\",\"lastModified\":\"2026-06-17T07:37:21.617\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check bloom filter map value size\\n\\nThis patch adds a missing check to bloom filter creating, rejecting\\nvalues above KMALLOC_MAX_SIZE. This brings the bloom map in line with\\nmany other map types.\\n\\nThe lack of this protection can cause kernel crashes for value sizes\\nthat overflow int\u0027s. Such a crash was caught by syzkaller. The next\\npatch adds more guard-rails at a lower level.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: Verificar el tama\u00f1o del valor del mapa del filtro de floraci\u00f3n. Este parche agrega una verificaci\u00f3n faltante para la creaci\u00f3n del filtro de floraci\u00f3n, rechazando valores superiores a KMALLOC_MAX_SIZE. Esto alinea el mapa de floraci\u00f3n con muchos otros tipos de mapas. La falta de esta protecci\u00f3n puede provocar fallas del kernel para tama\u00f1os de valores que desbordan los de int. Syzkaller capt\u00f3 tal accidente. El siguiente parche agrega m\u00e1s barandillas en un nivel inferior.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/bloom_filter.c\",\"tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9330986c03006ab1d33d243b7cfe598a7a3c1baa\",\"lessThan\":\"fa6995eeb62e74b5a1480c73fb7b420c270784d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9330986c03006ab1d33d243b7cfe598a7a3c1baa\",\"lessThan\":\"608e13706c8b6c658a0646f09ebced74ec367f7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9330986c03006ab1d33d243b7cfe598a7a3c1baa\",\"lessThan\":\"c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9330986c03006ab1d33d243b7cfe598a7a3c1baa\",\"lessThan\":\"a8d89feba7e54e691ca7c4efc2a6264fa83f3687\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/bloom_filter.c\",\"tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.91\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:16:07.190878Z\",\"id\":\"CVE-2024-36918\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"4F8C886C-75AA-469B-A6A9-12BF1A29C0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:45+00:00",
      "cve": "CVE-2024-36918",
      "id": "CVE-2024-36918",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Check bloom filter map value size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36918.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.111Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36918\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:16:07.190878Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.421Z\"}}], \"cna\": {\"title\": \"bpf: Check bloom filter map value size\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached purely through the `bpf()` syscall \\u2014 `BPF_MAP_CREATE` for a bloom-filter map with an oversized `value_size`, then `BPF_PROG_LOAD` of a program calling `bpf_map_push_elem()` on it. No network or remote-peer input is involved.\\nAC:L - Triggering is fully deterministic and attacker-controlled: pick any `value_size \u003e= 0x80000000` and any negative stack offset, and the signed overflow in `max_off + access_size` fires every time. There is no race, no timing window, and no memory-layout precondition needed to reach the out-of-bounds loop.\\nPR:L - `bpf_map_push_elem` is in the unprivileged section of `bpf_base_func_proto()`, and bloom-filter map creation has no per-map-type capability gate at all on 5.16\\u20136.3 (only `sysctl_unprivileged_bpf_disabled`), while on 6.9 a delegated bpffs BPF token grants `ns_capable(userns, CAP_BPF)` to an unprivileged containerized process. CAP_BPF is a deliberately reduced, non-root privilege routinely held by ordinary service accounts, so a basic low-privileged local context suffices.\\nUI:N - The attacker performs the entire sequence \\u2014 map creation plus program load \\u2014 from their own process. No other user or administrator has to do anything.\\nS:U - The corruption occurs in kernel heap memory belonging to the BPF verifier, within the same security authority as the exploiting process. No hypervisor, IOMMU, or other trust boundary is crossed.\\nC:H - The loop performs unbounded negative-index reads of `state-\u003estack[spi].slot_type[]` and `spilled_ptr`, and `mark_reg_read()` chases an out-of-bounds `parent` pointer, giving an out-of-bounds kernel-heap read primitive that a heap-groomed attacker can leverage for arbitrary memory disclosure.\\nI:H - With `clobber = true` the loop writes `*stype = STACK_MISC` out of bounds, `__mark_reg_unknown()`/`scrub_spilled_slot()` write a full `bpf_reg_state` and 8-byte slots out of bounds, and `mark_reg_read()` ORs `REG_LIVE_READ64` into an attacker-influenced wild pointer \\u2014 an out-of-bounds write usable for control-flow hijacking.\\nA:H - The overflowed loop iterates roughly two billion times descending ~120 bytes per 8 iterations, so it walks tens of gigabytes below the `stack` allocation and reliably faults on unmapped memory, producing a kernel oops/panic that any local user with map-create access can trigger at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9330986c03006ab1d33d243b7cfe598a7a3c1baa\", \"lessThan\": \"fa6995eeb62e74b5a1480c73fb7b420c270784d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9330986c03006ab1d33d243b7cfe598a7a3c1baa\", \"lessThan\": \"608e13706c8b6c658a0646f09ebced74ec367f7c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9330986c03006ab1d33d243b7cfe598a7a3c1baa\", \"lessThan\": \"c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9330986c03006ab1d33d243b7cfe598a7a3c1baa\", \"lessThan\": \"a8d89feba7e54e691ca7c4efc2a6264fa83f3687\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/bloom_filter.c\", \"tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/bloom_filter.c\", \"tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3\"}, {\"url\": \"https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c\"}, {\"url\": \"https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d\"}, {\"url\": \"https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check bloom filter map value size\\n\\nThis patch adds a missing check to bloom filter creating, rejecting\\nvalues above KMALLOC_MAX_SIZE. This brings the bloom map in line with\\nmany other map types.\\n\\nThe lack of this protection can cause kernel crashes for value sizes\\nthat overflow int\u0027s. Such a crash was caught by syzkaller. The next\\npatch adds more guard-rails at a lower level.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:03.979Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36918\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:03.979Z\", \"dateReserved\": \"2024-05-30T15:25:07.068Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:13.904Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.