CVE-2024-50203 (GCVE-0-2024-50203)

Vulnerability from cvelistv5 – Published: 2024-11-08 06:07 – Updated: 2026-05-23 15:54
VLAI
Title
bpf, arm64: Fix address emission with tag-based KASAN enabled
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 077149478497b2f00ff4fd9da2c892defa6418d8 , < 9e80f366ebfdfafc685fe83a84c34f7ef01cbe88 (git)
Affected: d9664e6ff040798a46cdc5d401064f55b8676c83 , < f521c2a0c0c4585f36d912bf62c852b88682c4f2 (git)
Affected: 19d3c179a37730caf600a97fed3794feac2b197b , < 7db1a2121f3c7903b8e397392beec563c3d00950 (git)
Affected: 19d3c179a37730caf600a97fed3794feac2b197b , < a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c (git)
Affected: 6d218fcc707d6b2c3616b6cd24b948fd4825cfec (git)
Affected: 6.10.3 , < 6.11 (semver)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e80f366ebfdfafc685fe83a84c34f7ef01cbe88",
              "status": "affected",
              "version": "077149478497b2f00ff4fd9da2c892defa6418d8",
              "versionType": "git"
            },
            {
              "lessThan": "f521c2a0c0c4585f36d912bf62c852b88682c4f2",
              "status": "affected",
              "version": "d9664e6ff040798a46cdc5d401064f55b8676c83",
              "versionType": "git"
            },
            {
              "lessThan": "7db1a2121f3c7903b8e397392beec563c3d00950",
              "status": "affected",
              "version": "19d3c179a37730caf600a97fed3794feac2b197b",
              "versionType": "git"
            },
            {
              "lessThan": "a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c",
              "status": "affected",
              "version": "19d3c179a37730caf600a97fed3794feac2b197b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d218fcc707d6b2c3616b6cd24b948fd4825cfec",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix address emission with tag-based KASAN enabled\n\nWhen BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image\nstruct on the stack is passed during the size calculation pass and\nan address on the heap is passed during code generation. This may\ncause a heap buffer overflow if the heap address is tagged because\nemit_a64_mov_i64() will emit longer code than it did during the size\ncalculation pass. The same problem could occur without tag-based\nKASAN if one of the 16-bit words of the stack address happened to\nbe all-ones during the size calculation pass. Fix the problem by\nassuming the worst case (4 instructions) when calculating the size\nof the bpf_tramp_image address emission."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:54:45.291Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e80f366ebfdfafc685fe83a84c34f7ef01cbe88"
        },
        {
          "url": "https://git.kernel.org/stable/c/f521c2a0c0c4585f36d912bf62c852b88682c4f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7db1a2121f3c7903b8e397392beec563c3d00950"
        },
        {
          "url": "https://git.kernel.org/stable/c/a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c"
        }
      ],
      "title": "bpf, arm64: Fix address emission with tag-based KASAN enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50203",
    "datePublished": "2024-11-08T06:07:54.207Z",
    "dateReserved": "2024-10-21T19:36:19.969Z",
    "dateUpdated": "2026-05-23T15:54:45.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50203",
      "date": "2026-07-23",
      "epss": "0.00231",
      "percentile": "0.14061"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50203\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-08T06:15:16.787\",\"lastModified\":\"2026-06-17T08:03:51.897\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, arm64: Fix address emission with tag-based KASAN enabled\\n\\nWhen BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image\\nstruct on the stack is passed during the size calculation pass and\\nan address on the heap is passed during code generation. This may\\ncause a heap buffer overflow if the heap address is tagged because\\nemit_a64_mov_i64() will emit longer code than it did during the size\\ncalculation pass. The same problem could occur without tag-based\\nKASAN if one of the 16-bit words of the stack address happened to\\nbe all-ones during the size calculation pass. Fix the problem by\\nassuming the worst case (4 instructions) when calculating the size\\nof the bpf_tramp_image address emission.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, arm64: Se corrige la emisi\u00f3n de direcciones con KASAN basado en etiquetas habilitado Cuando BPF_TRAMP_F_CALL_ORIG est\u00e1 habilitado, la direcci\u00f3n de una estructura bpf_tramp_image en la pila se pasa durante el paso de c\u00e1lculo de tama\u00f1o y se pasa una direcci\u00f3n en el mont\u00f3n durante la generaci\u00f3n de c\u00f3digo. Esto puede causar un desbordamiento del b\u00fafer del mont\u00f3n si la direcci\u00f3n del mont\u00f3n est\u00e1 etiquetada porque emit_a64_mov_i64() emitir\u00e1 un c\u00f3digo m\u00e1s largo que el que emiti\u00f3 durante el paso de c\u00e1lculo de tama\u00f1o. El mismo problema podr\u00eda ocurrir sin KASAN basado en etiquetas si una de las palabras de 16 bits de la direcci\u00f3n de la pila fuera todo unos durante el paso de c\u00e1lculo de tama\u00f1o. Solucione el problema asumiendo el peor caso (4 instrucciones) al calcular el tama\u00f1o de la emisi\u00f3n de la direcci\u00f3n bpf_tramp_image.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"077149478497b2f00ff4fd9da2c892defa6418d8\",\"lessThan\":\"9e80f366ebfdfafc685fe83a84c34f7ef01cbe88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d9664e6ff040798a46cdc5d401064f55b8676c83\",\"lessThan\":\"f521c2a0c0c4585f36d912bf62c852b88682c4f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19d3c179a37730caf600a97fed3794feac2b197b\",\"lessThan\":\"7db1a2121f3c7903b8e397392beec563c3d00950\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19d3c179a37730caf600a97fed3794feac2b197b\",\"lessThan\":\"a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d218fcc707d6b2c3616b6cd24b948fd4825cfec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.3\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.3\",\"versionEndExcluding\":\"6.11\",\"matchCriteriaId\":\"F2A79BF8-4D40-4CD5-9AF5-B6A3B67539DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"35973F0F-C32F-4D88-B0FE-C75F65A0002B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7db1a2121f3c7903b8e397392beec563c3d00950\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e80f366ebfdfafc685fe83a84c34f7ef01cbe88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f521c2a0c0c4585f36d912bf62c852b88682c4f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T11:16:24+00:00",
      "cve": "CVE-2024-50203",
      "id": "CVE-2024-50203",
      "initial_release_date": "2024-11-08T00:00:00+00:00",
      "product_status:known_affected": "48",
      "product_status:known_not_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, arm64: Fix address emission with tag-based KASAN enabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50203.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.