Vulnerability-Lookup

CVE-2024-45020 (GCVE-0-2024-45020)

Vulnerability from cvelistv5 – Published: 2024-09-11 15:13 – Updated: 2026-08-05 11:37

Title

bpf: Fix a kernel verifier crash in stacksafe()

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-29 15:48 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/7cad3174cc79519bf…
https://git.kernel.org/stable/c/6e3987ac310c74bb4…
https://git.kernel.org/stable/c/bed2eb964c70b780f…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: ab470fefce2837e66b771c60858118d50bb5bb10 , < 7cad3174cc79519bf5f6c4441780264416822c08 (git) Affected: 2793a8b015f7f1caadb9bce9c63dc659f7522676 , < 6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b (git) Affected: 2793a8b015f7f1caadb9bce9c63dc659f7522676 , < bed2eb964c70b780fb55925892a74f26cb590b25 (git) Affected: 6.6.15 , < 6.6.48 (semver)	guessed
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.6.48 , ≤ 6.6.* (semver) Unaffected: 6.10.7 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45020",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:48:14.999365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:48:29.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
              "status": "affected",
              "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
              "versionType": "git"
            },
            {
              "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
              "status": "affected",
              "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
              "versionType": "git"
            },
            {
              "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
              "status": "affected",
              "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.48",
              "status": "affected",
              "version": "6.6.15",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "6.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the bpf(BPF_PROG_LOAD) syscall, which requires local access to the system; there is no remote or adjacent-network path to the verifier.\nAC:L - The attacker fully authors the BPF program and deterministically constructs two converging paths with differing allocated_stack under an exact-comparison loop (as the upstream selftest demonstrates); no race or uncontrolled precondition is involved.\nPR:L - With unprivileged_bpf_disabled=0 an unprivileged local user can load SOCKET_FILTER/CGROUP_SKB programs, and BPF tokens (bpf_token_capable) delegate prog-load into unprivileged user namespaces; in both cases the verifier itself is the security boundary being broken.\nUI:N - The attacker triggers the bug entirely from their own process by loading a crafted BPF program; no action by any other user is required.\nS:U - The out-of-bounds access occurs in kernel memory within the same security authority as the attacking process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds slab read reaching up to ~8KB past a small kmalloc\u0027d bpf_stack_state array, far beyond a few bounded bytes, and the read bytes are compared against attacker-chosen slot_type values whose outcome is observable through verifier log/state-pruning behaviour, forming a heap-content oracle.\nI:H - Uncontrolled out-of-bounds heap data drives the state-equivalence verdict in exact-comparison mode, the mechanism that guarantees soundness of iterator and loop convergence; a wrongly-equal verdict prunes paths that were never verified, and an accepted unsafe program yields arbitrary kernel memory writes.\nA:H - When the compared frame has allocated_stack==0 the stack pointer is NULL/ZERO_SIZE_PTR, so the access is a deterministic kernel oops (the originally reported \"kernel verifier crash\"), and the slab case produces KASAN reports or faults on unmapped pages."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:44.844Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
        }
      ],
      "title": "bpf: Fix a kernel verifier crash in stacksafe()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45020",
    "datePublished": "2024-09-11T15:13:54.591Z",
    "dateReserved": "2024-08-21T05:34:56.683Z",
    "dateUpdated": "2026-08-05T11:37:44.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45020",
      "date": "2026-09-19",
      "epss": "0.00232",
      "percentile": "0.14345"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:03:16.000Z",
      "cve": "CVE-2024-45020",
      "id": "msrc_CVE-2024-45020",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix a kernel verifier crash in stacksafe()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45020.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
                    "status": "affected",
                    "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
                    "status": "affected",
                    "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
                    "status": "affected",
                    "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.48",
                    "status": "affected",
                    "version": "6.6.15",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.48",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE59A694-DE72-41A4-A18F-3B41532FCE94",
                    "versionEndExcluding": "6.6.48",
                    "versionStartIncluding": "6.6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2AFDFD1-D95A-4EB7-843B-5E7659518B67",
                    "versionEndExcluding": "6.10.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Se corrige un fallo del verificador del kernel en stacksafe() Daniel Hodges inform\u00f3 de un fallo del verificador del kernel al jugar con sched-ext. Una investigaci\u00f3n m\u00e1s profunda muestra que el fallo se debe a un acceso a memoria no v\u00e1lido en stacksafe(). M\u00e1s espec\u00edficamente, es el siguiente c\u00f3digo: if (exact != NOT_EXACT \u0026amp;\u0026amp; old-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] != cur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE]) return false; La \u0027i\u0027 itera old-\u0026gt;allocated_stack. Si cur-\u0026gt;allocated_stack \u0026lt; old-\u0026gt;allocated_stack, se producir\u00e1 el acceso fuera de l\u00edmites. Para solucionar el problema, agregue la comprobaci\u00f3n \u0027i \u0026gt;= cur-\u0026gt;allocated_stack\u0027 de modo que, si la condici\u00f3n es verdadera, stacksafe() deber\u00eda fallar. De lo contrario, el acceso a la memoria cur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] es legal."
          }
        ],
        "id": "CVE-2024-45020",
        "lastModified": "2026-08-04T11:20:11.413",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-45020",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:48:14.999365Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-11T16:15:07.050",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T08:46:25+00:00",
      "cve": "CVE-2024-45020",
      "id": "CVE-2024-45020",
      "initial_release_date": "2024-09-11T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "84",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix a kernel verifier crash in stacksafe()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45020.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-45020",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-29T15:48:14.999365Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-29T15:48:19.160Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "7cad3174cc79519bf5f6c4441780264416822c08",
                  "status": "affected",
                  "version": "ab470fefce2837e66b771c60858118d50bb5bb10",
                  "versionType": "git"
                },
                {
                  "lessThan": "6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b",
                  "status": "affected",
                  "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                  "versionType": "git"
                },
                {
                  "lessThan": "bed2eb964c70b780fb55925892a74f26cb590b25",
                  "status": "affected",
                  "version": "2793a8b015f7f1caadb9bce9c63dc659f7522676",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.6.48",
                  "status": "affected",
                  "version": "6.6.15",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/verifier.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.7"
                },
                {
                  "lessThan": "6.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.48",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.48",
                      "versionStartIncluding": "6.6.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.7",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "6.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT \u0026\u0026\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe \u0027i\u0027 iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add \u0027i \u003e= cur-\u003eallocated_stack\u0027 check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-23T15:53:20.817Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"
            },
            {
              "url": "https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"
            },
            {
              "url": "https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"
            }
          ],
          "title": "bpf: Fix a kernel verifier crash in stacksafe()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-45020",
        "datePublished": "2024-09-11T15:13:54.591Z",
        "dateReserved": "2024-08-21T05:34:56.683Z",
        "dateUpdated": "2026-05-23T15:53:20.817Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

MSRC_CVE-2024-45020

Vulnerability from csaf_microsoft - Published: 2024-09-01 07:00 - Updated: 2026-02-21 01:03

Summary

bpf: Fix a kernel verifier crash in stacksafe()

Scope

1 vulnerability in this advisory, including CVE-2024-45020.

CVE-2024-45020

Fixed: 2 products Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OESA-2024-2154 (CVE-2024-44939)

Vulnerability from osv_openeuler – Published: 2024-09-20 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix null ptr deref in dtInsertEntry

[syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time.

[Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL.(CVE-2024-44939)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: core: Check for unset descriptor

Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case.

This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found.

No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets.(CVE-2024-44960)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink

When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list.

Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.(CVE-2024-44970)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible UAF in ip6_xmit()

If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed.

We must use rcu_read_lock() to prevent a possible UAF.(CVE-2024-44985)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible UAF in ip6_finish_output2()

If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed.

We need to hold rcu_read_lock() to make sure the dst and associated idev are alive.(CVE-2024-44986)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent UAF in ip6_send_skb()

syzbot reported an UAF in ip6_send_skb() [1]

After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock().

A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()")

Another potential issue in ip6_finish_output2() is handled in a separate patch.

[1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530

CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK>

Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 _syssendmsg+0x525/0x7d0 net/socket.c:2597 _sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree. ---truncated---(CVE-2024-44987)

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: Fix out-of-bound access

If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).(CVE-2024-44988)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a kernel verifier crash in stacksafe()

Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code:

if (exact != NOT_EXACT &amp;&amp;
    old-&gt;stack[spi].slot_type[i % BPF_REG_SIZE] !=
    cur-&gt;stack[spi].slot_type[i % BPF_REG_SIZE])
        return false;

The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen.

To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.(CVE-2024-45020)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44939	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44960	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44970	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44985	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44986	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44987	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-44988	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-45020	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "bpftool-debuginfo-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-debuginfo-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-debugsource-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-devel-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-headers-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-source-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-tools-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-tools-debuginfo-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "kernel-tools-devel-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "perf-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "perf-debuginfo-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "python3-perf-6.6.0-42.0.0.49.oe2403.aarch64.rpm",
          "python3-perf-debuginfo-6.6.0-42.0.0.49.oe2403.aarch64.rpm"
        ],
        "src": [
          "kernel-6.6.0-42.0.0.49.oe2403.src.rpm"
        ],
        "x86_64": [
          "bpftool-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "bpftool-debuginfo-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-debuginfo-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-debugsource-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-devel-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-headers-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-source-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-tools-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-tools-debuginfo-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "kernel-tools-devel-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "perf-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "perf-debuginfo-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "python3-perf-6.6.0-42.0.0.49.oe2403.x86_64.rpm",
          "python3-perf-debuginfo-6.6.0-42.0.0.49.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.0-42.0.0.49.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\njfs: fix null ptr deref in dtInsertEntry\r\n\r\n[syzbot reported]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713\n...\n[Analyze]\nIn dtInsertEntry(), when the pointer h has the same value as p, after writing\nname in UniStrncpy_to_le(), p-\u0026gt;header.flag will be cleared. This will cause the\npreviously true judgment \u0026quot;p-\u0026gt;header.flag \u0026amp; BT-LEAF\u0026quot; to change to no after writing\nthe name operation, this leads to entering an incorrect branch and accessing the\nuninitialized object ih when judging this condition for the second time.\r\n\r\n[Fix]\nAfter got the page, check freelist first, if freelist == 0 then exit dtInsert()\nand return -EINVAL.(CVE-2024-44939)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: gadget: core: Check for unset descriptor\r\n\r\nMake sure the descriptor has been set before looking at maxpacket.\nThis fixes a null pointer panic in this case.\r\n\r\nThis may happen if the gadget doesn\u0026apos;t properly set up the endpoint\nfor the current speed, or the gadget descriptors are malformed and\nthe descriptor for the speed/endpoint are not found.\r\n\r\nNo current gadget driver is known to have this problem, but this\nmay cause a hard-to-find bug during development of new gadgets.(CVE-2024-44960)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\r\n\r\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\r\n\r\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again.(CVE-2024-44970)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent possible UAF in ip6_xmit()\r\n\r\nIf skb_expand_head() returns NULL, skb has been freed\nand the associated dst/idev could also have been freed.\r\n\r\nWe must use rcu_read_lock() to prevent a possible UAF.(CVE-2024-44985)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fix possible UAF in ip6_finish_output2()\r\n\r\nIf skb_expand_head() returns NULL, skb has been freed\nand associated dst/idev could also have been freed.\r\n\r\nWe need to hold rcu_read_lock() to make sure the dst and\nassociated idev are alive.(CVE-2024-44986)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent UAF in ip6_send_skb()\r\n\r\nsyzbot reported an UAF in ip6_send_skb() [1]\r\n\r\nAfter ip6_local_out() has returned, we no longer can safely\ndereference rt, unless we hold rcu_read_lock().\r\n\r\nA similar issue has been fixed in commit\na688caa34beb (\u0026quot;ipv6: take rcu lock in rawv6_send_hdrinc()\u0026quot;)\r\n\r\nAnother potential issue in ip6_finish_output2() is handled in a\nseparate patch.\r\n\r\n[1]\n BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\nRead of size 8 at addr ffff88806dde4858 by task syz.1.380/6530\r\n\r\nCPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:93 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\n  rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588\n  rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  sock_write_iter+0x2dd/0x400 net/socket.c:1160\n do_iter_readv_writev+0x60a/0x890\n  vfs_writev+0x37c/0xbb0 fs/read_write.c:971\n  do_writev+0x1b1/0x350 fs/read_write.c:1018\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f936bf79e79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79\nRDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004\nRBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 6530:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  unpoison_slab_object mm/kasan/common.c:312 [inline]\n  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338\n  kasan_slab_alloc include/linux/kasan.h:201 [inline]\n  slab_post_alloc_hook mm/slub.c:3988 [inline]\n  slab_alloc_node mm/slub.c:4037 [inline]\n  kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044\n  dst_alloc+0x12b/0x190 net/core/dst.c:89\n  ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670\n  make_blackhole net/xfrm/xfrm_policy.c:3120 [inline]\n  xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313\n  ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257\n  rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n  ___sys_sendmsg net/socket.c:2651 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\nFreed by task 45:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n  poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n  __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n  kasan_slab_free include/linux/kasan.h:184 [inline]\n  slab_free_hook mm/slub.c:2252 [inline]\n  slab_free mm/slub.c:4473 [inline]\n  kmem_cache_free+0x145/0x350 mm/slub.c:4548\n  dst_destroy+0x2ac/0x460 net/core/dst.c:124\n  rcu_do_batch kernel/rcu/tree.c:2569 [inline]\n  rcu_core+0xafd/0x1830 kernel/rcu/tree.\n---truncated---(CVE-2024-44987)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: dsa: mv88e6xxx: Fix out-of-bound access\r\n\r\nIf an ATU violation was caused by a CPU Load operation, the SPID could\nbe larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).(CVE-2024-44988)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fix a kernel verifier crash in stacksafe()\r\n\r\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\r\n\r\n    if (exact != NOT_EXACT \u0026amp;\u0026amp;\n        old-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\r\n\r\nThe \u0026apos;i\u0026apos; iterates old-\u0026gt;allocated_stack.\nIf cur-\u0026gt;allocated_stack \u0026lt; old-\u0026gt;allocated_stack the out-of-bound\naccess will happen.\r\n\r\nTo fix the issue add \u0026apos;i \u0026gt;= cur-\u0026gt;allocated_stack\u0026apos; check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u0026gt;stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.(CVE-2024-45020)",
  "id": "OESA-2024-2154",
  "modified": "2026-08-06T11:07:37Z",
  "published": "2024-09-20T11:07:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2154"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44939"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44960"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44970"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44985"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44986"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44987"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44988"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45020"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2024-44939",
    "CVE-2024-44960",
    "CVE-2024-44970",
    "CVE-2024-44985",
    "CVE-2024-44986",
    "CVE-2024-44987",
    "CVE-2024-44988",
    "CVE-2024-45020"
  ]
}

RHSA-2024:11486

Vulnerability from csaf_redhat - Published: 2024-12-19 00:58 - Updated: 2026-09-14 12:21

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Scope

17 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

A flaw was found in the Linux kernel. A local attacker with specific privileges could trigger an invalid memory access within the BPF (Berkeley Packet Filter) verifier's `stacksafe()` function. This out-of-bounds access could lead to a kernel crash, resulting in a Denial of Service (DoS) for the system.

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Fixed: 280 products

https://access.redhat.com/errata/RHSA-2024:11486

Open the full advisory

SUSE-SU-2024:3551-1

Vulnerability from csaf_suse - Published: 2024-10-08 15:03 - Updated: 2024-10-08 15:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

162 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 35 products

Open the full advisory

SUSE-SU-2024:3553-1

Vulnerability from csaf_suse - Published: 2024-10-08 15:10 - Updated: 2024-10-08 15:10

Summary

Security update for the Linux Kernel

Severity

Important

Scope

147 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2024:3561-1

Vulnerability from csaf_suse - Published: 2024-10-09 08:45 - Updated: 2024-10-09 08:45

Summary

Security update for the Linux Kernel

Severity

Important

Scope

162 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 181 products

Open the full advisory

SUSE-SU-2024:3564-1

Vulnerability from csaf_suse - Published: 2024-10-09 09:09 - Updated: 2024-10-09 09:09

Summary

Security update for the Linux Kernel

Severity

Important

Scope

162 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 31 products

Open the full advisory

SUSE-SU-2024:3569-1

Vulnerability from csaf_suse - Published: 2024-10-09 11:52 - Updated: 2024-10-09 11:52

Summary

Security update for the Linux Kernel

Severity

Important

Scope

130 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 67 products

Open the full advisory

SUSE-SU-2024:3587-1

Vulnerability from csaf_suse - Published: 2024-10-10 13:29 - Updated: 2024-10-10 13:29

Summary

Security update for the Linux Kernel

Severity

Important

Scope

132 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 35 products

Open the full advisory

SUSE-SU-2024:3592-1

Vulnerability from csaf_suse - Published: 2024-10-10 16:03 - Updated: 2024-10-10 16:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

130 vulnerabilities in this advisory, including CVE-2024-45020.

CVE-2024-45020

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 37 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-45020 (GCVE-0-2024-45020)

OESA-2024-2154 (CVE-2024-44939)

Tags

Sightings

Nomenclature

Related by attack behaviour