CVE-2024-35903

MEDIUM

Linux Kernel 6.2-6.6.25, 6.7-6.8.4 - Denial of Service via BPF Call Depth Accounting

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code. Otherwise we will skip some instructions and most likely crash.

References (3)

Core 3

Core References

Patch

https://git.kernel.org/stable/c/3f9d57c771656bfd651e22edcfdb5f60e62542d4

Patch

https://git.kernel.org/stable/c/81166178cf0a0062a22b1b3b5368183d39577028

Patch

https://git.kernel.org/stable/c/9d98aa088386aee3db1b7b60b800c0fde0654a4a

Scores

CVSS v3 5.5

EPSS 0.0021

EPSS Percentile 11.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (12)

linux/Kernel 6.2.0 - 6.6.26linux

linux/Kernel 6.7.0 - 6.8.5linux

Linux/Linux < 6.2

Linux/Linux 6.2

Linux/Linux 6.6.26 - 6.6.*

Linux/Linux 6.8.5 - 6.8.*

Linux/Linux 6.9

Linux/Linux b2e9dfe54be4d023124d588d6f03d16a9c0d2507 - 3f9d57c771656bfd651e22edcfdb5f60e62542d4

Linux/Linux b2e9dfe54be4d023124d588d6f03d16a9c0d2507 - 81166178cf0a0062a22b1b3b5368183d39577028

Linux/Linux b2e9dfe54be4d023124d588d6f03d16a9c0d2507 - 9d98aa088386aee3db1b7b60b800c0fde0654a4a

... and 2 more

Published May 19, 2024

Tracked Since Feb 18, 2026