GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41048 (GCVE-0-2024-41048)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:32 – Updated: 2026-08-05 11:34
VLAI
Title
skmsg: Skip zero length skb in sk_msg_recvmsg
Summary
In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg When running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch platform, the following kernel panic occurs: [...] Oops[#1]: CPU: 22 PID: 2824 Comm: test_progs Tainted: G OE 6.10.0-rc2+ #18 Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018 ... ... ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560 ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 0000000c (PPLV0 +PIE +PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) BADV: 0000000000000040 PRID: 0014c011 (Loongson-64bit, Loongson-3C5000) Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...) Stack : ... Call Trace: [<9000000004162774>] copy_page_to_iter+0x74/0x1c0 [<90000000048bf6c0>] sk_msg_recvmsg+0x120/0x560 [<90000000049f2b90>] tcp_bpf_recvmsg_parser+0x170/0x4e0 [<90000000049aae34>] inet_recvmsg+0x54/0x100 [<900000000481ad5c>] sock_recvmsg+0x7c/0xe0 [<900000000481e1a8>] __sys_recvfrom+0x108/0x1c0 [<900000000481e27c>] sys_recvfrom+0x1c/0x40 [<9000000004c076ec>] do_syscall+0x8c/0xc0 [<9000000003731da4>] handle_syscall+0xc4/0x160 Code: ... ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception Kernel relocated by 0x3510000 .text @ 0x9000000003710000 .data @ 0x9000000004d70000 .bss @ 0x9000000006469400 ---[ end Kernel panic - not syncing: Fatal exception ]--- [...] This crash happens every time when running sockmap_skb_verdict_shutdown subtest in sockmap_basic. This crash is because a NULL pointer is passed to page_address() in the sk_msg_recvmsg(). Due to the different implementations depending on the architecture, page_address(NULL) will trigger a panic on Loongarch platform but not on x86 platform. So this bug was hidden on x86 platform for a while, but now it is exposed on Loongarch platform. The root cause is that a zero length skb (skb->len == 0) was put on the queue. This zero length skb is a TCP FIN packet, which was sent by shutdown(), invoked in test_sockmap_skb_verdict_shutdown(): shutdown(p1, SHUT_WR); In this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no page is put to this sge (see sg_set_page in sg_set_page), but this empty sge is queued into ingress_msg list. And in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by sg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it to kmap_local_page() and to page_address(), then kernel panics. To solve this, we should skip this zero length skb. So in sk_msg_recvmsg(), if copy is zero, that means it's a zero length skb, skip invoking copy_page_to_iter(). We are using the EFAULT return triggered by copy_page_to_iter to check for is_fin in tcp_bpf.c.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:22 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632 (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < fb61d7b9fb6ef0032de469499a54dab4c7260d0d (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < b180739b45a38b4caa88fe16bb5273072e6613dc (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < f8bd689f37f4198a4c61c4684f591ba639595b97 (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < f0c18025693707ec344a70b6887f7450bf4c826b (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.15.163 , ≤ 5.15.* (semver)
Unaffected: 6.1.100 , ≤ 6.1.* (semver)
Unaffected: 6.6.41 , ≤ 6.6.* (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:59:48.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:50.876207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:02.036Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "fb61d7b9fb6ef0032de469499a54dab4c7260d0d",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "b180739b45a38b4caa88fe16bb5273072e6613dc",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "f8bd689f37f4198a4c61c4684f591ba639595b97",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "f0c18025693707ec344a70b6887f7450bf4c826b",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.163",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.100",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.41",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nskmsg: Skip zero length skb in sk_msg_recvmsg\n\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\nplatform, the following kernel panic occurs:\n\n  [...]\n  Oops[#1]:\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\n     ... ...\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n   BADV: 0000000000000040\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\n  Stack : ...\n  Call Trace:\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\n  Code: ...\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception\n  Kernel relocated by 0x3510000\n   .text @ 0x9000000003710000\n   .data @ 0x9000000004d70000\n   .bss  @ 0x9000000006469400\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\n  [...]\n\nThis crash happens every time when running sockmap_skb_verdict_shutdown\nsubtest in sockmap_basic.\n\nThis crash is because a NULL pointer is passed to page_address() in the\nsk_msg_recvmsg(). Due to the different implementations depending on the\narchitecture, page_address(NULL) will trigger a panic on Loongarch\nplatform but not on x86 platform. So this bug was hidden on x86 platform\nfor a while, but now it is exposed on Loongarch platform. The root cause\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\n\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\ninvoked in test_sockmap_skb_verdict_shutdown():\n\n\tshutdown(p1, SHUT_WR);\n\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\nsge is queued into ingress_msg list.\n\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\nto kmap_local_page() and to page_address(), then kernel panics.\n\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\nif copy is zero, that means it\u0027s a zero length skb, skip invoking\ncopy_page_to_iter(). We are using the EFAULT return triggered by\ncopy_page_to_iter to check for is_fin in tcp_bpf.c."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The malformed zero-length sk_msg originates directly from a TCP FIN segment received from a remote peer over the network, and the crash occurs on the ordinary `recvmsg()` of a network-facing service whose sockets are managed by a BPF sockmap (e.g. service-mesh/L7 proxy socket acceleration). The oops trace is squarely in the TCP receive path (`__sys_recvfrom` \u2192 `inet_recvmsg` \u2192 `tcp_bpf_recvmsg_parser` \u2192 `sk_msg_recvmsg`).\nAC:L - The remote peer simply completes a TCP handshake and half-closes the connection; `tcp_bpf_recvmsg_parser()` itself notes this FIN path is \"the typical case\", and the commit states the crash \"happens every time\" in the reproducer. No race, no memory-layout grooming, and the attacker fully controls the FIN.\nPR:N - No credentials or prior authentication are needed \u2014 any client able to open a TCP connection to the sockmap-enrolled service can send the FIN. The CAP_NET_ADMIN/CAP_BPF needed to install the sockmap belongs to the victim\u0027s own configuration, not to the attacker.\nUI:N - The FIN makes the socket readable (EPOLLIN) and the server\u0027s normal epoll/recv loop consumes it automatically, triggering the dereference with no action by any local user.\nS:U - The fault and its consequences are confined to the kernel of the affected host; no VM, IOMMU, or other security-authority boundary is crossed.\nC:N - `copy` is zero, so `_copy_to_iter()` transfers no bytes and no kernel memory is exposed to userspace; the defect is purely a NULL `struct page` pointer being dereferenced by `page_address()`/`PageHighMem()`.\nI:N - There is no write primitive \u2014 the code path only reads `struct page` fields at a NULL base and copies zero bytes, so no kernel or user data can be modified.\nA:H - The NULL pointer dereference produces a kernel Oops and \"Kernel panic - not syncing: Fatal exception\", and because it fires on every graceful close it can be triggered repeatedly and trivially by any remote client."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:59.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b"
        }
      ],
      "title": "skmsg: Skip zero length skb in sk_msg_recvmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41048",
    "datePublished": "2024-07-29T14:32:05.224Z",
    "dateReserved": "2024-07-12T12:17:45.625Z",
    "dateUpdated": "2026-08-05T11:34:59.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41048",
      "date": "2026-09-17",
      "epss": "0.00799",
      "percentile": "0.54849"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41048\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:13.103\",\"lastModified\":\"2026-08-04T11:19:22.693\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nskmsg: Skip zero length skb in sk_msg_recvmsg\\n\\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\\nplatform, the following kernel panic occurs:\\n\\n  [...]\\n  Oops[#1]:\\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\\n     ... ...\\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n   BADV: 0000000000000040\\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\\n  Stack : ...\\n  Call Trace:\\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\\n  Code: ...\\n  ---[ end trace 0000000000000000 ]---\\n  Kernel panic - not syncing: Fatal exception\\n  Kernel relocated by 0x3510000\\n   .text @ 0x9000000003710000\\n   .data @ 0x9000000004d70000\\n   .bss  @ 0x9000000006469400\\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\\n  [...]\\n\\nThis crash happens every time when running sockmap_skb_verdict_shutdown\\nsubtest in sockmap_basic.\\n\\nThis crash is because a NULL pointer is passed to page_address() in the\\nsk_msg_recvmsg(). Due to the different implementations depending on the\\narchitecture, page_address(NULL) will trigger a panic on Loongarch\\nplatform but not on x86 platform. So this bug was hidden on x86 platform\\nfor a while, but now it is exposed on Loongarch platform. The root cause\\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\\n\\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\\ninvoked in test_sockmap_skb_verdict_shutdown():\\n\\n\\tshutdown(p1, SHUT_WR);\\n\\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\\nsge is queued into ingress_msg list.\\n\\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\\nto kmap_local_page() and to page_address(), then kernel panics.\\n\\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\\nif copy is zero, that means it\u0027s a zero length skb, skip invoking\\ncopy_page_to_iter(). We are using the EFAULT return triggered by\\ncopy_page_to_iter to check for is_fin in tcp_bpf.c.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: skmsg: omitir skb de longitud cero en sk_msg_recvmsg Al ejecutar autopruebas de BPF (./test_progs -t sockmap_basic) en una plataforma Loongarch, se produce el siguiente p\u00e1nico del kernel: [...] Ups[ #1]: CPU: 22 PID: 2824 Comm: test_progs Contaminado: G OE 6.10.0-rc2+ #18 Nombre del hardware: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018 ... ... ra: 90000000048bf6c0 sk_msg_recvmsg+0x120 /0x560 ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 0000000c (PPLV0 +PIE +PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EssubCode=0) BADV: 00000000000000040 PRID: 0014c011 (Loongson-64bit, Loongson -3C5000) M\u00f3dulos vinculados en: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack Procesar test_progs (pid: 2824, threadinfo=0000000000863a31, task=...) Pila: ... Seguimiento de llamadas: [\u0026lt;9000000004162774\u0026gt;] 1c0 [ \u0026lt;90000000048bf6c0\u0026gt;] sk_msg_recvmsg+0x120/0x560 [\u0026lt;90000000049f2b90\u0026gt;] tcp_bpf_recvmsg_parser+0x170/0x4e0 [\u0026lt;90000000049aae34\u0026gt;] 0x54/0x100 [\u0026lt;900000000481ad5c\u0026gt;] sock_recvmsg+0x7c/0xe0 [\u0026lt;900000000481e1a8\u0026gt;] __sys_recvfrom+0x108/0x1c0 [ \u0026lt;900000000481e27c\u0026gt;] sys_recvfrom+0x1c/0x40 [\u0026lt;9000000004c076ec\u0026gt;] do_syscall+0x8c/0xc0 [\u0026lt;9000000003731da4\u0026gt;] handle_syscall+0xc4/0x160 C\u00f3digo: ... ---[ end trace 0000000 000000000 ]--- P\u00e1nico del kernel: no se sincroniza : Excepci\u00f3n fatal Kernel reubicado por 0x3510000 .text @ 0x9000000003710000 .data @ 0x9000000004d70000 .bss @ 0x9000000006469400 ---[ fin del p\u00e1nico del kernel - no se sincroniza: excepci\u00f3n fatal ]--- [...] Este bloqueo ocurre cada vez que se ejecuta sockmap_ subprueba skb_verdict_shutdown en sockmap_basic. Este bloqueo se debe a que se pasa un puntero NULL a page_address() en sk_msg_recvmsg(). Debido a las diferentes implementaciones seg\u00fan la arquitectura, page_address(NULL) provocar\u00e1 un p\u00e1nico en la plataforma Loongarch pero no en la plataforma x86. Entonces, este error estuvo oculto en la plataforma x86 por un tiempo, pero ahora est\u00e1 expuesto en la plataforma Loongarch. La causa principal es que se coloc\u00f3 en la cola un skb de longitud cero (skb-\u0026gt;len == 0). Este skb de longitud cero es un paquete TCP FIN, que fue enviado por apagado(), invocado en test_sockmap_skb_verdict_shutdown(): apagado(p1, SHUT_WR); En este caso, en sk_psock_skb_ingress_enqueue(), num_sge es cero y no se coloca ninguna p\u00e1gina en este sge (consulte sg_set_page en sg_set_page), pero este sge vac\u00edo se pone en cola en la lista ingress_msg. Y en sk_msg_recvmsg(), se usa este sge vac\u00edo, y sg_page(sge) obtiene una p\u00e1gina NULL. Pase esta p\u00e1gina NULL a copy_page_to_iter(), que la pasa a kmap_local_page() y a page_address(), luego el kernel entra en p\u00e1nico. Para resolver esto, debemos omitir este skb de longitud cero. Entonces, en sk_msg_recvmsg(), si la copia es cero, eso significa que es un skb de longitud cero, omita la invocaci\u00f3n de copy_page_to_iter(). Estamos utilizando el retorno EFAULT activado por copy_page_to_iter para verificar is_fin en tcp_bpf.c.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"fb61d7b9fb6ef0032de469499a54dab4c7260d0d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"b180739b45a38b4caa88fe16bb5273072e6613dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"f8bd689f37f4198a4c61c4684f591ba639595b97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"f0c18025693707ec344a70b6887f7450bf4c826b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.163\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.100\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.41\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:22:50.876207Z\",\"id\":\"CVE-2024-41048\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.15.163\",\"matchCriteriaId\":\"692341AC-F3D5-4E78-B7B8-FED866CC513E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.100\",\"matchCriteriaId\":\"100CDF74-4DB5-4FC6-A54B-BDBDB0C27137\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.41\",\"matchCriteriaId\":\"96AC42B8-D66D-4AC5-B466-E9BA7910FA29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T08:32:31+00:00",
      "cve": "CVE-2024-41048",
      "id": "CVE-2024-41048",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_affected": "58",
      "product_status:known_not_affected": "140",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: skmsg: Skip zero length skb in sk_msg_recvmsg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41048.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:59:48.428Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41048\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:22:50.876207Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.281Z\"}}], \"cna\": {\"title\": \"skmsg: Skip zero length skb in sk_msg_recvmsg\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"fb61d7b9fb6ef0032de469499a54dab4c7260d0d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"b180739b45a38b4caa88fe16bb5273072e6613dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"f8bd689f37f4198a4c61c4684f591ba639595b97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"f0c18025693707ec344a70b6887f7450bf4c826b\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/skmsg.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.100\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.41\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/skmsg.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/195b7bcdfc5adc5b2468f279dd9eb7eebd2e7632\"}, {\"url\": \"https://git.kernel.org/stable/c/fb61d7b9fb6ef0032de469499a54dab4c7260d0d\"}, {\"url\": \"https://git.kernel.org/stable/c/b180739b45a38b4caa88fe16bb5273072e6613dc\"}, {\"url\": \"https://git.kernel.org/stable/c/f8bd689f37f4198a4c61c4684f591ba639595b97\"}, {\"url\": \"https://git.kernel.org/stable/c/f0c18025693707ec344a70b6887f7450bf4c826b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nskmsg: Skip zero length skb in sk_msg_recvmsg\\n\\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\\nplatform, the following kernel panic occurs:\\n\\n  [...]\\n  Oops[#1]:\\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\\n     ... ...\\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n   BADV: 0000000000000040\\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\\n  Stack : ...\\n  Call Trace:\\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\\n  Code: ...\\n  ---[ end trace 0000000000000000 ]---\\n  Kernel panic - not syncing: Fatal exception\\n  Kernel relocated by 0x3510000\\n   .text @ 0x9000000003710000\\n   .data @ 0x9000000004d70000\\n   .bss  @ 0x9000000006469400\\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\\n  [...]\\n\\nThis crash happens every time when running sockmap_skb_verdict_shutdown\\nsubtest in sockmap_basic.\\n\\nThis crash is because a NULL pointer is passed to page_address() in the\\nsk_msg_recvmsg(). Due to the different implementations depending on the\\narchitecture, page_address(NULL) will trigger a panic on Loongarch\\nplatform but not on x86 platform. So this bug was hidden on x86 platform\\nfor a while, but now it is exposed on Loongarch platform. The root cause\\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\\n\\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\\ninvoked in test_sockmap_skb_verdict_shutdown():\\n\\n\\tshutdown(p1, SHUT_WR);\\n\\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\\nsge is queued into ingress_msg list.\\n\\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\\nto kmap_local_page() and to page_address(), then kernel panics.\\n\\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\\nif copy is zero, that means it\u0027s a zero length skb, skip invoking\\ncopy_page_to_iter(). We are using the EFAULT return triggered by\\ncopy_page_to_iter to check for is_fin in tcp_bpf.c.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.163\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.100\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.41\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:20:54.907Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41048\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T21:59:48.428Z\", \"dateReserved\": \"2024-07-12T12:17:45.625Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:32:05.224Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.