CVE-2024-53099 bpf: Check validity of link->type in bpf_link_show_fdinfo()
A missing validity check in the Linux kernel BPF subsystem allows out-of-bounds memory access, potentially causing crashes or information leaks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53099?
CVE-2024-53099 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check validity of link->type in bpf_link_show_fdinfo()
If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing bpf_link_type_strs[link->type] may result in an out-of-bounds access.
To spot such missed invocations early in the future, checking the validity of link->type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed.
Weakness: CWE-125
Which versions are affected by CVE-2024-53099?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53099?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-53099 being exploited?
There is no known exploitation of CVE-2024-53099 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-54595, AZL-54626, BELL-CVE-2024-53099, DEBIAN-CVE-2024-53099, GHSA-xmv6-x39j-72gg, UBUNTU-CVE-2024-53099.