CVE-2024-42072
published 2024-07-29CVE-2024-42072: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset. Zac's syzbot crafted a bpf prog that exposed two…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix may_goto with negative offset.
Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto.
The 1st bug is the way may_goto is patched. When offset is negative
it should be patched differently.
The 2nd bug is in the verifier:
when current state may_goto_depth is equal to visited state may_goto_depth
it means there is an actual infinite loop. It's not correct to prune
exploration of the program at this point.
Note, that this check doesn't limit the program to only one may_goto insn,
since 2nd and any further may_goto will increment may_goto_depth only
in the queued state pushed for future exploration. The current state
will have may_goto_depth == 0 regardless of number of may_goto insns
and the verifier has to explore the program until bpf_exit.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.9.8-1 (forky) | linux 6.9.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 011832b97b311bb9e3c27945bc0d1089a14209c9 < 175827e04f4be53f3dfb57edf12d0d49b18fd939 | 175827e04f4be53f3dfb57edf12d0d49b18fd939 |
| linux | linux | >= 011832b97b311bb9e3c27945bc0d1089a14209c9 < 2b2efe1937ca9f8815884bd4dcd5b32733025103 | 2b2efe1937ca9f8815884bd4dcd5b32733025103 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.9.8-1 | 6.9.8-1 |
| linux | linux_kernel | >= 0 < 6.9.8-1 | 6.9.8-1 |
| linux | linux_kernel | >= 6.9 < 6.9.8 | 6.9.8 |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hwc3-9p27-c4j6: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix may_goto with negative offset
ghsa_unreviewed·2024-07-29
CVE-2024-42072 [HIGH] GHSA-hwc3-9p27-c4j6: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix may_goto with negative offset
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix may_goto with negative offset.
Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto.
The 1st bug is the way may_goto is patched. When offset is negative
it should be patched differently.
The 2nd bug is in the verifier:
when current state may_goto_depth is equal to visited state may_goto_depth
it means there is an actual infinite loop. It's not correct to prune
exploration of the program at this point.
Note, that this check doesn't limit the program to only one may_goto insn,
since 2nd and any further may_goto will increment may_goto_depth only
in the queued state pushed for future exploration. The current state
will have may_goto_depth == 0 regardless of number of may_goto insns
and the verifier has
OSV
CVE-2024-42072: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset
osv·2024-07-29·CVSS 7.8
CVE-2024-42072 [HIGH] CVE-2024-42072: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset. Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto. The 1st bug is the way may_goto is patched. When offset is negative it should be patched differently. The 2nd bug is in the verifier: when current state may_goto_depth is equal to visited state may_goto_depth it means there is an actual infinite loop. It's not correct to prune exploration of the program at this point. Note, that this check doesn't limit the program to only one may_goto insn, since 2nd and any further may_goto will increment may_goto_depth only in the queued state pushed for future exploration. The current state will have may_goto_depth == 0 regardless of number of may_goto insns and the verifier has t
Microsoft
CVE-2024-42072: NIST NVD Details: https://nvd
vendor_msrc·2024-12-10·CVSS 7.8
CVE-2024-42072 [HIGH] CVE-2024-42072: NIST NVD Details: https://nvd
NIST NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2024-42072
Mariner: Mariner
416baaa9-dc9f-4396-8d5f-8c081fb06d67: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Customer Action Required: Yes
Exploit Status: DOS:N/A
Remediation: kernel
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-42072
Red Hat
kernel: bpf: Fix may_goto with negative offset.
vendor_redhat·2024-07-29·CVSS 7.8
CVE-2024-42072 [HIGH] CWE-822 kernel: bpf: Fix may_goto with negative offset.
kernel: bpf: Fix may_goto with negative offset.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix may_goto with negative offset.
Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto.
The 1st bug is the way may_goto is patched. When offset is negative
it should be patched differently.
The 2nd bug is in the verifier:
when current state may_goto_depth is equal to visited state may_goto_depth
it means there is an actual infinite loop. It's not correct to prune
exploration of the program at this point.
Note, that this check doesn't limit the program to only one may_goto insn,
since 2nd and any further may_goto will increment may_goto_depth only
in the queued state pushed for future exploration. The current state
will have may_goto_depth == 0 regardless o
Debian
CVE-2024-42072: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ma...
vendor_debian·2024·CVSS 7.8
CVE-2024-42072 [HIGH] CVE-2024-42072: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ma...
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset. Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto. The 1st bug is the way may_goto is patched. When offset is negative it should be patched differently. The 2nd bug is in the verifier: when current state may_goto_depth is equal to visited state may_goto_depth it means there is an actual infinite loop. It's not correct to prune exploration of the program at this point. Note, that this check doesn't limit the program to only one may_goto insn, since 2nd and any further may_goto will increment may_goto_depth only in the queued state pushed for future exploration. The current state will have may_goto_depth == 0 regardless of number of may_goto insns and the verifier has t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-29
Published