CVE-2024-50163

MEDIUM EPSS 11.9%
Published Nov 7, 20241y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Nov 7, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger. With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
11.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥5.14  –  <5.15.170
linuxlinux_kernel*≥5.16  –  <6.1.115
linuxlinux_kernel*≥6.2  –  <6.6.59
linuxlinux_kernel*≥6.7  –  <6.11.6
linuxlinux_kernel6.12any
linuxlinux_kernel6.12any
linuxlinux_kernel6.12any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826
    Patch