GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-45020 (GCVE-0-2024-45020)

Vulnerability from cvelistv5 – Published: 2024-09-11 15:13 – Updated: 2026-08-05 11:37
VLAI
Title
bpf: Fix a kernel verifier crash in stacksafe()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 15:48 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ab470fefce2837e66b771c60858118d50bb5bb10 , < 7cad3174cc79519bf5f6c4441780264416822c08 (git)
Affected: 2793a8b015f7f1caadb9bce9c63dc659f7522676 , < 6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b (git)
Affected: 2793a8b015f7f1caadb9bce9c63dc659f7522676 , < bed2eb964c70b780fb55925892a74f26cb590b25 (git)
Affected: 6.6.15 , < 6.6.48 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45020",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:48:14.999365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:48:29.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
              "status": "affected",
              "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
              "versionType": "git"
            },
            {
              "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
              "status": "affected",
              "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
              "versionType": "git"
            },
            {
              "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
              "status": "affected",
              "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.48",
              "status": "affected",
              "version": "6.6.15",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "6.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the bpf(BPF_PROG_LOAD) syscall, which requires local access to the system; there is no remote or adjacent-network path to the verifier.\nAC:L - The attacker fully authors the BPF program and deterministically constructs two converging paths with differing allocated_stack under an exact-comparison loop (as the upstream selftest demonstrates); no race or uncontrolled precondition is involved.\nPR:L - With unprivileged_bpf_disabled=0 an unprivileged local user can load SOCKET_FILTER/CGROUP_SKB programs, and BPF tokens (bpf_token_capable) delegate prog-load into unprivileged user namespaces; in both cases the verifier itself is the security boundary being broken.\nUI:N - The attacker triggers the bug entirely from their own process by loading a crafted BPF program; no action by any other user is required.\nS:U - The out-of-bounds access occurs in kernel memory within the same security authority as the attacking process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds slab read reaching up to ~8KB past a small kmalloc\u0027d bpf_stack_state array, far beyond a few bounded bytes, and the read bytes are compared against attacker-chosen slot_type values whose outcome is observable through verifier log/state-pruning behaviour, forming a heap-content oracle.\nI:H - Uncontrolled out-of-bounds heap data drives the state-equivalence verdict in exact-comparison mode, the mechanism that guarantees soundness of iterator and loop convergence; a wrongly-equal verdict prunes paths that were never verified, and an accepted unsafe program yields arbitrary kernel memory writes.\nA:H - When the compared frame has allocated_stack==0 the stack pointer is NULL/ZERO_SIZE_PTR, so the access is a deterministic kernel oops (the originally reported \"kernel verifier crash\"), and the slab case produces KASAN reports or faults on unmapped pages."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:44.844Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
        }
      ],
      "title": "bpf: Fix a kernel verifier crash in stacksafe()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45020",
    "datePublished": "2024-09-11T15:13:54.591Z",
    "dateReserved": "2024-08-21T05:34:56.683Z",
    "dateUpdated": "2026-08-05T11:37:44.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45020",
      "date": "2026-09-19",
      "epss": "0.00232",
      "percentile": "0.14345"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:03:16.000Z",
      "cve": "CVE-2024-45020",
      "id": "msrc_CVE-2024-45020",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix a kernel verifier crash in stacksafe()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45020.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
                    "status": "affected",
                    "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
                    "status": "affected",
                    "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
                    "status": "affected",
                    "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.48",
                    "status": "affected",
                    "version": "6.6.15",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.48",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE59A694-DE72-41A4-A18F-3B41532FCE94",
                    "versionEndExcluding": "6.6.48",
                    "versionStartIncluding": "6.6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2AFDFD1-D95A-4EB7-843B-5E7659518B67",
                    "versionEndExcluding": "6.10.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Se corrige un fallo del verificador del kernel en stacksafe() Daniel Hodges inform\u00f3 de un fallo del verificador del kernel al jugar con sched-ext. Una investigaci\u00f3n m\u00e1s profunda muestra que el fallo se debe a un acceso a memoria no v\u00e1lido en stacksafe(). M\u00e1s espec\u00edficamente, es el siguiente c\u00f3digo: if (exact != NOT_EXACT \u0026amp;\u0026amp; old-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] != cur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE]) return false; La \u0027i\u0027 itera old-\u0026gt;allocated_stack. Si cur-\u0026gt;allocated_stack \u0026lt; old-\u0026gt;allocated_stack, se producir\u00e1 el acceso fuera de l\u00edmites. Para solucionar el problema, agregue la comprobaci\u00f3n \u0027i \u0026gt;= cur-\u0026gt;allocated_stack\u0027 de modo que, si la condici\u00f3n es verdadera, stacksafe() deber\u00eda fallar. De lo contrario, el acceso a la memoria cur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] es legal."
          }
        ],
        "id": "CVE-2024-45020",
        "lastModified": "2026-08-04T11:20:11.413",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-45020",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:48:14.999365Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-11T16:15:07.050",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T08:46:25+00:00",
      "cve": "CVE-2024-45020",
      "id": "CVE-2024-45020",
      "initial_release_date": "2024-09-11T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "84",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix a kernel verifier crash in stacksafe()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45020.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-45020",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-29T15:48:14.999365Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-29T15:48:19.160Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
                  "status": "affected",
                  "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
                  "versionType": "git"
                },
                {
                  "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
                  "status": "affected",
                  "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                  "versionType": "git"
                },
                {
                  "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
                  "status": "affected",
                  "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.6.48",
                  "status": "affected",
                  "version": "6.6.15",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.7"
                },
                {
                  "lessThan": "6.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.48",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.48",
                      "versionStartIncluding": "6.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.7",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-23T15:53:20.817Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
            },
            {
              "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
            },
            {
              "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
            }
          ],
          "title": "bpf: Fix a kernel verifier crash in stacksafe()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-45020",
        "datePublished": "2024-09-11T15:13:54.591Z",
        "dateReserved": "2024-08-21T05:34:56.683Z",
        "dateUpdated": "2026-05-23T15:53:20.817Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.