CVE-2024-50203

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A heap buffer overflow issue has been resolved in the Linux kernel. The problem occurs when BPF TRAMP F CALL ORIG is enabled, and the address of a bpf tramp image struct on the stack is passed during the size calculation pass, while an address on the heap is passed during code generation. This may cause a heap buffer overflow if the heap address is tagged because emit a64 mov i64() will emit longer code than it did during the size calculation pass. The same problem could occur without tag-based KASAN if one of the 16-bit words of the stack address happened to be all-ones during the size calculation pass. The issue is fixed by assuming the worst case when calculating the size of the bpf tramp image address emission.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.