CVE-2024-26588 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds Read8 documents7 sources
Severity
7.8HIGHNVD
OSV7.5
EPSS
0.0%
top 96.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LinuxLinux KernelDebian Linux+4 more
Timeline
PublishedFeb 22
Latest updateMar 11

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers an unhandled page fault: # ./test_tag [ 130.640218] CPU 0 Unable to handle kernel paging request at virtual address ffff80001b898004, era == 9000000003137f7c, ra == 9000000003139e70 [ 130.640501] Oops[#3]: [ 130.640553] CPU: 0 PID: 1326 Comm: test_tag Tainted: G D O 6.7.0-rc4-loong-devel-gb62ab1a397cf #47 61985c1d94084daa2432f771daa45b56b10d8d2a [ …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

▶NVDlinux/linux_kernel6.1 — 6.1.75+2
▶Debianlinux/linux_kernel< 6.1.76-1+2
▶CVEListV5linux/linuxbbfddb904df6f82a5948687a2d57766216b9bc0f — 4631c2dd69d928bca396f9f58baeddf85e14ced5+4

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
OSV
linux-oem-6.1 vulnerabilities↗2024-03-11
▶
OSV
CVE-2024-26588: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers an↗2024-02-22
▶
GHSA
GHSA-x6p5-7c22-qrq6: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers a↗2024-02-22
▶

📋Vendor Advisories

4
Ubuntu
Linux kernel (OEM) vulnerabilities↗2024-03-11
▶
Red Hat
kernel: bpf: Prevent out-of-bounds memory access on LoongArch↗2024-02-22
▶
Microsoft
LoongArch: BPF: Prevent out-of-bounds memory access↗2024-02-13
▶
Debian
CVE-2024-26588: linux - In the Linux kernel, the following vulnerability has been resolved: LoongArch: ...↗2024
▶