CVE-2024-49987
bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
Published Oct 21, 2024
CVSS 3.1 · 5.5 Medium
EPSS < 1%
KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:
bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
When netfilter has no entry to display, qsort is called with
qsort(NULL, 0, ...). This results in undefined behavior, as UBSan
reports:
net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null
Although the C standard does not explicitly state whether calling qsort
with a NULL pointer when the size is 0 constitutes undefined behavior,
Section 7.1.4 of the C standard (Use of library functions) mentions:
"Each of the following statements applies unless explicitly stated
otherwise in the detailed descriptions that follow: If an argument to a
function has an invalid value (such as a value outside the domain of
the function, or a pointer outside the address space of the program, or
a null pointer, or a pointer to non-modifiable storage when the
corresponding parameter is not const-qualified) or a type (after
promotion) not expected by a function with variable number of
arguments, the behavior is undefined."
To avoid this, add an early return when nf_link_info is NULL to prevent
calling qsort with a NULL pointer.
bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
When netfilter has no entry to display, qsort is called with
qsort(NULL, 0, ...). This results in undefined behavior, as UBSan
reports:
net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null
Although the C standard does not explicitly state whether calling qsort
with a NULL pointer when the size is 0 constitutes undefined behavior,
Section 7.1.4 of the C standard (Use of library functions) mentions:
"Each of the following statements applies unless explicitly stated
otherwise in the detailed descriptions that follow: If an argument to a
function has an invalid value (such as a value outside the domain of
the function, or a pointer outside the address space of the program, or
a null pointer, or a pointer to non-modifiable storage when the
corresponding parameter is not const-qualified) or a type (after
promotion) not expected by a function with variable number of
arguments, the behavior is undefined."
To avoid this, add an early return when nf_link_info is NULL to prevent
calling qsort with a NULL pointer.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-7276-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7277-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7301-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7303-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7303-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7303-3 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7304-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7310-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7311-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7384-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-7384-2 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-7385-1 | Linux kernel (IBM) vulnerabilities |
| Ubuntu USN |
USN-7386-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-7403-1 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-7468-1 | Linux kernel (Azure, N-Series) vulnerabilities |
Metrics
No CVSS v4.0
Attack Vector Local
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.235% probability within 30 days)
Exploitation none
Automatable no
Technical Impact partial
References
History
Oct 28, 2024 4:45 PM
First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-476 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
Oct 23, 2024 1:30 AM
Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Oct 22, 2024 2:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Oct 21, 2024 6:15 PM
Description updated. Title updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions: "Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer. | |
| Title | bpftool: Fix undefined behavior in qsort(NULL, 0, ...) | |
| References |
|
Subscriptions
Weaknesses
