Kernel Verifier Crash in Linux Package: CVE-2024-45020
Summary
DEBIAN-CVE-2024-45020: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and software interactions. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability affects the kernel's BPF (Berkeley Packet Filter) verifier, which is responsible for ensuring the safety of BPF programs. A flaw in this verifier can lead to crashes, impacting system reliability.
Vulnerability Detail
The vulnerability identified as CVE-2024-45020 arises from a crash in the kernel verifier during the execution of the stacksafe() function. This issue was reported by Daniel Hodges and is caused by invalid memory access when the verifier processes certain BPF programs. Specifically, the crash occurs when the verifier attempts to access memory outside the bounds of the allocated stack, leading to potential system instability. If exploited, this vulnerability could result in a denial of service, causing the kernel to crash unexpectedly.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2024-45020 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper memory access in the kernel verifier. Users are strongly advised to update to the patched version to ensure system stability and security. Monitoring tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
CVE-2024-45020 is a vulnerability in the Linux kernel that causes a crash in the kernel verifier due to invalid memory access.
This vulnerability can lead to system crashes, resulting in a denial of service and impacting system reliability.
You should update your Linux package to version 6.10.7-1 or later to mitigate the vulnerability.
Currently, there are no workarounds available. The recommended action is to apply the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
