CVE-2024-38566
MEDIUMLinux kernel - Info Disclosure
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix verifier assumptions about socket->sk The verifier assumes that 'sk' field in 'struct socket' is valid and non-NULL when 'socket' pointer itself is trusted and non-NULL. That may not be the case when socket was just created and passed to LSM socket_accept hook. Fix this verifier assumption and adjust tests.
Exploits (1)
github
WORKING POC
by fabrizioperna · cpoc
https://github.com/fabrizioperna/ebpf-verifier-cve-pocs/tree/main/CVE-2024-38566
References (4)
Scores
CVSS v3
5.5
EPSS
0.0002
EPSS Percentile
4.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Details
Status
published
Products (4)
linux/Kernel
6.4.0 - 6.6.33linux
linux/Kernel
6.7.0 - 6.8.12linux
linux/Kernel
6.9.0 - 6.9.3linux
linux/linux_kernel
6.4 - 6.6.33
Published
Jun 19, 2024
Tracked Since
Feb 18, 2026