CVE-2024-43843 riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
An out-of-bounds write in the Linux kernel's RISC-V BPF trampoline preparation allows attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43843?
CVE-2024-43843 is a high-severity memory corruption vulnerability in Linux kernel, published on 17 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
We get the size of the trampoline image during the dry run phase and allocate memory based on that size. The allocated image will then be populated with instructions during the real patch phase. But after commit 26ef208c209a ("bpf: Use arch_bpf_trampoline_size"), the `im` argument is inconsistent in the dry run and real patch phase. This may cause emit_imm in RV64 to generate a different number of instructions when generating the 'im' address, potentially causing out-of-bounds issues. Let's emit the maximum number of instructions for the "im" address during dry run to fix this problem.
Weakness: CWE-131
Which versions are affected by CVE-2024-43843?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43843?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-43843 being exploited?
There is no known exploitation of CVE-2024-43843 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-43843, DEBIAN-CVE-2024-43843, GHSA-r657-mr7r-rf9x, UBUNTU-CVE-2024-43843.