CVE-2024-35905

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35905
In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail. This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 Patch
https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 Patch
https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 Patch
https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 Patch
https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d Patch
https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 Patch
https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 Patch
https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 Patch
https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 Patch
https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 Patch
https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d Patch
https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

30 Dec 2024, 19:47

Type Values Removed Values Added
First Time Debian debian Linux
Debian
Linux
Linux linux Kernel
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-190
CWE-129
References () https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 - () https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 - Patch
References () https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 - () https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 - Patch
References () https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 - () https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 - Patch
References () https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 - () https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 - Patch
References () https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d - () https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d - Patch
References () https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 - () https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Mailing List

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 - () https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103 -
References () https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 - () https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69 -
References () https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 - () https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69 -
References () https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 - () https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1 -
References () https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d - () https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d -
References () https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 - () https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8 -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 22:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Protección contra desbordamiento int para el tamaño de acceso a la pila. Este parche reintroduce la protección contra que el tamaño de acceso a la memoria de la pila sea negativo; el tamaño de acceso puede parecer negativo como resultado de desbordar su representación int firmada. En realidad, esto no debería suceder, ya que existen otras protecciones en el camino, pero debemos protegernos contra ello de todos modos. A una ruta de código le faltaban dichas protecciones (corregidas en el parche anterior de la serie), lo que provocaba accesos a matrices fuera de los límites en check_stack_range_initialized(). Este parche hace que falle la verificación de un programa con un tamaño de acceso tan absurdo. Esta verificación solía existir de una manera más indirecta, pero se eliminó inadvertidamente en a833a17aeac7.
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2024-12-30 19:47

NVD link : CVE-2024-35905

Mitre link : CVE-2024-35905

CVE.ORG link : CVE-2024-35905

JSON object : View

Products Affected

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-129

Improper Validation of Array Index

CWE-190

Integer Overflow or Wraparound