NetSight
IP …
high7.8

CVE-2024-50262

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node st…

Impact

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.16 before 4.19.323
from 4.20 before 5.4.285
from 5.5 before 5.10.229
from 5.11 before 5.15.171
from 5.16 before 6.1.116
from 6.2 before 6.6.60

Weakness classification

CWE-787

References