CVE-2024-42151
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
30/07/2024
Last modified:
09/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable<br />
<br />
Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first<br />
parameter of the test_1() function. Mark this parameter as nullable to<br />
make verifier aware of such possibility.<br />
Otherwise, NULL check in the test_1() code:<br />
<br />
SEC("struct_ops/test_1")<br />
int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)<br />
{<br />
if (!state)<br />
return ...;<br />
<br />
... access state ...<br />
}<br />
<br />
Might be removed by verifier, thus triggering NULL pointer dereference<br />
under certain conditions.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.9.9 (excluding) |
To consult the complete list of CPE names with products and versions, see this page