Vulnerability-Lookup

GHSA-W83R-GJ25-6VRC

Vulnerability from github – Published: 2024-11-08 06:30 – Updated: 2025-05-22 15:34

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fix address emission with tag-based KASAN enabled

When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-08T06:15:16Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix address emission with tag-based KASAN enabled\n\nWhen BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image\nstruct on the stack is passed during the size calculation pass and\nan address on the heap is passed during code generation. This may\ncause a heap buffer overflow if the heap address is tagged because\nemit_a64_mov_i64() will emit longer code than it did during the size\ncalculation pass. The same problem could occur without tag-based\nKASAN if one of the 16-bit words of the stack address happened to\nbe all-ones during the size calculation pass. Fix the problem by\nassuming the worst case (4 instructions) when calculating the size\nof the bpf_tramp_image address emission.",
  "id": "GHSA-w83r-gj25-6vrc",
  "modified": "2025-05-22T15:34:45Z",
  "published": "2024-11-08T06:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50203"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7db1a2121f3c7903b8e397392beec563c3d00950"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9e80f366ebfdfafc685fe83a84c34f7ef01cbe88"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f521c2a0c0c4585f36d912bf62c852b88682c4f2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-50203 (GCVE-0-2024-50203)

Vulnerability from cvelistv5 – Published: 2024-11-08 06:07 – Updated: 2026-08-05 11:42

Title

bpf, arm64: Fix address emission with tag-based KASAN enabled

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image struct on the stack is passed during the size calculation pass and an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit_a64_mov_i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. Fix the problem by assuming the worst case (4 instructions) when calculating the size of the bpf_tramp_image address emission.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/9e80f366ebfdfafc6…
https://git.kernel.org/stable/c/f521c2a0c0c4585f3…
https://git.kernel.org/stable/c/7db1a2121f3c7903b…
https://git.kernel.org/stable/c/a552e2ef5fd1a6c78…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 077149478497b2f00ff4fd9da2c892defa6418d8 , < 9e80f366ebfdfafc685fe83a84c34f7ef01cbe88 (git) Affected: d9664e6ff040798a46cdc5d401064f55b8676c83 , < f521c2a0c0c4585f36d912bf62c852b88682c4f2 (git) Affected: 19d3c179a37730caf600a97fed3794feac2b197b , < 7db1a2121f3c7903b8e397392beec563c3d00950 (git) Affected: 19d3c179a37730caf600a97fed3794feac2b197b , < a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c (git) Affected: 6d218fcc707d6b2c3616b6cd24b948fd4825cfec (git) Affected: 6.10.3 , < 6.11 (semver)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.11.6 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e80f366ebfdfafc685fe83a84c34f7ef01cbe88",
              "status": "affected",
              "version": "077149478497b2f00ff4fd9da2c892defa6418d8",
              "versionType": "git"
            },
            {
              "lessThan": "f521c2a0c0c4585f36d912bf62c852b88682c4f2",
              "status": "affected",
              "version": "d9664e6ff040798a46cdc5d401064f55b8676c83",
              "versionType": "git"
            },
            {
              "lessThan": "7db1a2121f3c7903b8e397392beec563c3d00950",
              "status": "affected",
              "version": "19d3c179a37730caf600a97fed3794feac2b197b",
              "versionType": "git"
            },
            {
              "lessThan": "a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c",
              "status": "affected",
              "version": "19d3c179a37730caf600a97fed3794feac2b197b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d218fcc707d6b2c3616b6cd24b948fd4825cfec",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix address emission with tag-based KASAN enabled\n\nWhen BPF_TRAMP_F_CALL_ORIG is enabled, the address of a bpf_tramp_image\nstruct on the stack is passed during the size calculation pass and\nan address on the heap is passed during code generation. This may\ncause a heap buffer overflow if the heap address is tagged because\nemit_a64_mov_i64() will emit longer code than it did during the size\ncalculation pass. The same problem could occur without tag-based\nKASAN if one of the 16-bit words of the stack address happened to\nbe all-ones during the size calculation pass. Fix the problem by\nassuming the worst case (4 instructions) when calculating the size\nof the bpf_tramp_image address emission."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable JIT path is reached only through the local `bpf()` syscall when attaching an fexit/fmod_ret tracing program or registering a struct_ops, which triggers `bpf_trampoline_update()` \u2192 `arch_bpf_trampoline_size()`/`arch_prepare_bpf_trampoline()`. There is no remote or adjacent-network path into arm64 trampoline code generation.\nAC:L - The attacker can attach and detach trampolines repeatedly, and with tag-based KASAN (KASAN_SW_TAGS/HW_TAGS, shipped in Android GKI kernels on MTE hardware) the tagged `kzalloc()` address routinely needs a 4-instruction encoding while the stack address needed only 3, so retrying until the size mismatch occurs is entirely under the attacker\u0027s control. Slab grooming further lets the attacker influence which address the `bpf_tramp_image` receives.\nPR:L - Loading and attaching the tracing/struct_ops program requires CAP_BPF plus CAP_PERFMON, which are held by ordinary non-root service accounts on real deployments (Android, tracing/observability daemons) and can be delegated into a user namespace via BPF tokens, so this is a low-privileged rather than full-root-only operation. No further authentication gate exists between the attach request and `prepare_trampoline()`.\nUI:N - The overflow happens synchronously inside the attacker\u0027s own `bpf()` syscall during trampoline code generation. No victim action, mount, or file open is needed.\nS:U - The corrupted `kvmalloc()` buffer and the truncated trampoline both live in kernel memory managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a heap out-of-bounds write past a kmalloc\u0027d JIT scratch buffer, and `validate_code()` additionally reads out of bounds; such slab corruption is leverageable into an arbitrary-read primitive by grooming a useful victim object next to the allocation. The truncated trampoline can also transfer control into adjacent `bpf_prog_pack` code, exposing arbitrary kernel memory.\nI:H - The undercounted size causes instruction words to be written past the end of the heap allocation, corrupting neighbouring slab objects, and the installed executable trampoline is missing its epilogue/`RET` so the CPU runs off into adjacent JIT text. Both give control-flow-hijack potential in kernel context, i.e. arbitrary modification.\nA:H - Slab redzone/next-object corruption trips KASAN or slab debugging and the truncated trampoline falls through into `AARCH64_BREAK_FAULT` fill in the prog pack, producing a kernel oops/panic. This is triggerable at will, so the system can be crashed repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:28.257Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e80f366ebfdfafc685fe83a84c34f7ef01cbe88"
        },
        {
          "url": "https://git.kernel.org/stable/c/f521c2a0c0c4585f36d912bf62c852b88682c4f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7db1a2121f3c7903b8e397392beec563c3d00950"
        },
        {
          "url": "https://git.kernel.org/stable/c/a552e2ef5fd1a6c78267cd4ec5a9b49aa11bbb1c"
        }
      ],
      "title": "bpf, arm64: Fix address emission with tag-based KASAN enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50203",
    "datePublished": "2024-11-08T06:07:54.207Z",
    "dateReserved": "2024-10-21T19:36:19.969Z",
    "dateUpdated": "2026-08-05T11:42:28.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.