CVE-2024-36918

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36918
In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c Patch
https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 Patch
https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d Patch
https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 Patch
https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c Patch
https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 Patch
https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d Patch
https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
History

17 Sep 2025, 22:18

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c - () https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c - Patch
References () https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 - () https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 - Patch
References () https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d - () https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d - Patch
References () https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 - () https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CWE CWE-190
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 09:22

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c - () https://git.kernel.org/stable/c/608e13706c8b6c658a0646f09ebced74ec367f7c -
References () https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 - () https://git.kernel.org/stable/c/a8d89feba7e54e691ca7c4efc2a6264fa83f3687 -
References () https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d - () https://git.kernel.org/stable/c/c418afb9bf23e2f2b76cb819601e4a5d9dbab42d -
References () https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 - () https://git.kernel.org/stable/c/fa6995eeb62e74b5a1480c73fb7b420c270784d3 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: Verificar el tamaño del valor del mapa del filtro de floración. Este parche agrega una verificación faltante para la creación del filtro de floración, rechazando valores superiores a KMALLOC_MAX_SIZE. Esto alinea el mapa de floración con muchos otros tipos de mapas. La falta de esta protección puede provocar fallas del kernel para tamaños de valores que desbordan los de int. Syzkaller captó tal accidente. El siguiente parche agrega más barandillas en un nivel inferior.

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-09-17 22:18

NVD link : CVE-2024-36918

Mitre link : CVE-2024-36918

CVE.ORG link : CVE-2024-36918

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound