CVE-2024-27050

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27050", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.213Z", "datePublished": "2024-05-01T12:54:35.555Z", "dateUpdated": "2026-08-05T11:29:13.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:13.148Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Use OPTS_SET() macro in bpf_xdp_query()\n\nWhen the feature_flags and xdp_zc_max_segs fields were added to the libbpf\nbpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.\nThis causes libbpf to write to those fields unconditionally, which means\nthat programs compiled against an older version of libbpf (with a smaller\nsize of the bpf_xdp_query_opts struct) will have its stack corrupted by\nlibbpf writing out of bounds.\n\nThe patch adding the feature_flags field has an early bail out if the\nfeature_flags field is not part of the opts struct (via the OPTS_HAS)\nmacro, but the patch adding xdp_zc_max_segs does not. For consistency, this\nfix just changes the assignments to both fields to use the OPTS_SET()\nmacro."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is in the userspace libbpf library and is reached by a local process calling bpf_xdp_query(), which issues local netlink (RTM_GETLINK / netdev genl) requests. No remote or adjacent network input reaches the vulnerable write.\nAC:L - The out-of-bounds write is fully deterministic \u2014 any binary compiled against a pre-6.6 bpf_xdp_query_opts (sz==40) triggers the 4-byte write at offset 40 on every successful query, with no race or memory-layout luck required.\nPR:L - An unprivileged local user can execute an affected libbpf consumer; the RTM_GETLINK dump and NETDEV_CMD_DEV_GET queries on the path require no capabilities, and the forged-netlink-reply amplification also needs only ordinary local user access.\nUI:N - The attacker runs the affected libbpf-linked program directly, and the corrupting write happens automatically inside bpf_xdp_query() with no victim action required.\nS:U - The out-of-bounds write lands on the calling process's own stack; libbpf and its caller are the same security authority, and no sandbox, VM, or IOMMU boundary is crossed.\nC:H - The bug is an out-of-bounds write whose value is attacker-influenceable via a forged netlink reply (libbpf_netlink_recv() never verifies the sender is the kernel); corrupting an adjacent stack local such as a length or index in a privileged XDP management process can be leveraged to disclose that process's memory.\nI:H - This is a stack out-of-bounds write of a 32-bit value past the caller's bpf_xdp_query_opts object, and per the OOB-write mapping it constitutes memory corruption of adjacent state that can be steered toward control-flow or data-flow tampering in the affected process.\nA:H - Overwriting four bytes beyond the caller's stack object can clobber an adjacent local or stack metadata, causing __stack_chk_fail aborts or SIGSEGV crashes of the affected application, and the write occurs on every query so it is repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["tools/lib/bpf/netlink.c"], "versions": [{"version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c", "status": "affected", "versionType": "git"}, {"version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "682ddd62abd4bdcee7584246903e7a2df005fe0d", "status": "affected", "versionType": "git"}, {"version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e", "status": "affected", "versionType": "git"}, {"version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "92a871ab9fa59a74d013bc04f321026a057618e7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["tools/lib/bpf/netlink.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.7.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.8.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c"}, {"url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d"}, {"url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e"}, {"url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7"}], "title": "libbpf: Use OPTS_SET() macro in bpf_xdp_query()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "affected": [{"vendor": "linux", "product": "acrn", "cpes": ["cpe:2.3:o:linux:acrn:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.8.2", "status": "unaffected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.7.11", "status": "unaffected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.6.23", "status": "unaffected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-16T18:27:13.162013Z", "id": "CVE-2024-27050", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T20:58:16.092Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.913Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.913Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27050", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-16T18:27:13.162013Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:acrn:*:*:*:*:*:*:*:*"], "vendor": "linux", "product": "acrn", "versions": [{"status": "unaffected", "version": "6.8.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.7.11"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.6.23"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T18:25:15.576Z"}}], "cna": {"title": "libbpf: Use OPTS_SET() macro in bpf_xdp_query()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is in the userspace libbpf library and is reached by a local process calling bpf_xdp_query(), which issues local netlink (RTM_GETLINK / netdev genl) requests. No remote or adjacent network input reaches the vulnerable write.\nAC:L - The out-of-bounds write is fully deterministic \u2014 any binary compiled against a pre-6.6 bpf_xdp_query_opts (sz==40) triggers the 4-byte write at offset 40 on every successful query, with no race or memory-layout luck required.\nPR:L - An unprivileged local user can execute an affected libbpf consumer; the RTM_GETLINK dump and NETDEV_CMD_DEV_GET queries on the path require no capabilities, and the forged-netlink-reply amplification also needs only ordinary local user access.\nUI:N - The attacker runs the affected libbpf-linked program directly, and the corrupting write happens automatically inside bpf_xdp_query() with no victim action required.\nS:U - The out-of-bounds write lands on the calling process's own stack; libbpf and its caller are the same security authority, and no sandbox, VM, or IOMMU boundary is crossed.\nC:H - The bug is an out-of-bounds write whose value is attacker-influenceable via a forged netlink reply (libbpf_netlink_recv() never verifies the sender is the kernel); corrupting an adjacent stack local such as a length or index in a privileged XDP management process can be leveraged to disclose that process's memory.\nI:H - This is a stack out-of-bounds write of a 32-bit value past the caller's bpf_xdp_query_opts object, and per the OOB-write mapping it constitutes memory corruption of adjacent state that can be steered toward control-flow or data-flow tampering in the affected process.\nA:H - Overwriting four bytes beyond the caller's stack object can clobber an adjacent local or stack metadata, causing __stack_chk_fail aborts or SIGSEGV crashes of the affected application, and the write occurs on every query so it is repeatable at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c", "versionType": "git"}, {"status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "682ddd62abd4bdcee7584246903e7a2df005fe0d", "versionType": "git"}, {"status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e", "versionType": "git"}, {"status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "lessThan": "92a871ab9fa59a74d013bc04f321026a057618e7", "versionType": "git"}], "programFiles": ["tools/lib/bpf/netlink.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.23", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.11", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.2", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["tools/lib/bpf/netlink.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c"}, {"url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d"}, {"url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e"}, {"url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Use OPTS_SET() macro in bpf_xdp_query()\n\nWhen the feature_flags and xdp_zc_max_segs fields were added to the libbpf\nbpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.\nThis causes libbpf to write to those fields unconditionally, which means\nthat programs compiled against an older version of libbpf (with a smaller\nsize of the bpf_xdp_query_opts struct) will have its stack corrupted by\nlibbpf writing out of bounds.\n\nThe patch adding the feature_flags field has an early bail out if the\nfeature_flags field is not part of the opts struct (via the OPTS_HAS)\nmacro, but the patch adding xdp_zc_max_segs does not. For consistency, this\nfix just changes the assignments to both fields to use the OPTS_SET()\nmacro."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.23", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.11", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.2", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:13.148Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27050", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:29:13.148Z", "dateReserved": "2024-02-19T14:20:24.213Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T12:54:35.555Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["tools/lib/bpf/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c", "status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "versionType": "git"}, {"lessThan": "682ddd62abd4bdcee7584246903e7a2df005fe0d", "status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "versionType": "git"}, {"lessThan": "cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e", "status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "versionType": "git"}, {"lessThan": "92a871ab9fa59a74d013bc04f321026a057618e7", "status": "affected", "version": "13ce2daa259a3bfbc9a5aeeee8b9a87058703731", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["tools/lib/bpf/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:acrn:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "acrn", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.8.2"}]}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.7.11"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.6.23"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B28A88F-F85F-4008-8F7C-44FC9152916E", "versionEndExcluding": "6.6.23", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD", "versionEndExcluding": "6.7.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1", "versionEndExcluding": "6.8.2", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Use OPTS_SET() macro in bpf_xdp_query()\n\nWhen the feature_flags and xdp_zc_max_segs fields were added to the libbpf\nbpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.\nThis causes libbpf to write to those fields unconditionally, which means\nthat programs compiled against an older version of libbpf (with a smaller\nsize of the bpf_xdp_query_opts struct) will have its stack corrupted by\nlibbpf writing out of bounds.\n\nThe patch adding the feature_flags field has an early bail out if the\nfeature_flags field is not part of the opts struct (via the OPTS_HAS)\nmacro, but the patch adding xdp_zc_max_segs does not. For consistency, this\nfix just changes the assignments to both fields to use the OPTS_SET()\nmacro."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: libbpf: use la macro OPTS_SET() en bpf_xdp_query() Cuando los campos feature_flags y xdp_zc_max_segs se agregaron a libbpf bpf_xdp_query_opts, el c\u00f3digo que los escribi\u00f3 no us\u00f3 la macro OPTS_SET(). Esto hace que libbpf escriba en esos campos incondicionalmente, lo que significa que los programas compilados con una versi\u00f3n anterior de libbpf (con un tama\u00f1o m\u00e1s peque\u00f1o de la estructura bpf_xdp_query_opts) tendr\u00e1n su pila da\u00f1ada por la escritura de libbpf fuera de los l\u00edmites. El parche que agrega el campo feature_flags tiene un rescate anticipado si el campo feature_flags no es parte de la estructura opts (a trav\u00e9s de la macro OPTS_HAS), pero el parche que agrega xdp_zc_max_segs no lo hace. Para mantener la coherencia, esta soluci\u00f3n simplemente cambia las asignaciones a ambos campos para usar la macro OPTS_SET()."}], "id": "CVE-2024-27050", "lastModified": "2026-08-04T11:17:37.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27050", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-16T18:27:13.162013Z", "version": "2.0.3"}}]}, "published": "2024-05-01T13:15:50.070", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: libbpf: Use OPTS_SET() macro in bpf_xdp_query()", "id": "2278427", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278427"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlibbpf: Use OPTS_SET() macro in bpf_xdp_query()\nWhen the feature_flags and xdp_zc_max_segs fields were added to the libbpf\nbpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.\nThis causes libbpf to write to those fields unconditionally, which means\nthat programs compiled against an older version of libbpf (with a smaller\nsize of the bpf_xdp_query_opts struct) will have its stack corrupted by\nlibbpf writing out of bounds.\nThe patch adding the feature_flags field has an early bail out if the\nfeature_flags field is not part of the opts struct (via the OPTS_HAS)\nmacro, but the patch adding xdp_zc_max_segs does not. For consistency, this\nfix just changes the assignments to both fields to use the OPTS_SET()\nmacro.", "A vulnerability was found in the Linux kernel\u2019s bpf_xdp_query() function, where an out-of-bounds write error can occur due to a misalignment between the older and newer versions of the bpf_xdp_query_opts structure. This issue occurs when an older version of libbpf interacts with a newer version, leading to stack corruption because the latest version of the structure introduced new fields, feature_flags, and xdp_zc_max_segs. As such, the older version, which has smaller struct sizes, may have its stack corrupted by the newer version writing beyond the allocated space. This vulnerability can lead to memory corruption or system instability."], "name": "CVE-2024-27050", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27050\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27050\nhttps://lore.kernel.org/linux-cve-announce/2024050114-CVE-2024-27050-b829@gregkh/T"], "threat_severity": "Moderate"}

{}