CVE-2024-50162— bpf: devmap: provide rxq after redirect
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在重定向后未提供rxq。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1498.001 · Direct Network FloodAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | cb261b594b4108668e00f565184c7c221efe0359< fe068afb868660fe683a8391c6c17ecbe2254922 |
affected |
cb261b594b4108668e00f565184c7c221efe0359< a778fbe087c19f4ece5f5fc14173328f070c3803 |
affected | ||
cb261b594b4108668e00f565184c7c221efe0359< 49454f09936a9a96edfb047156889879cb4001eb |
affected | ||
cb261b594b4108668e00f565184c7c221efe0359< 9167d1c274a336e4763eeb3f3f9cb763c55df5aa |
affected | ||
cb261b594b4108668e00f565184c7c221efe0359< ca9984c5f0ab3690d98b13937b2485a978c8dd73 |
affected | ||
5.14 |
affected | ||
< 5.14 |
unaffected | ||
5.15.170≤ 5.15.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-50162
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bpf: devmap: provide rxq after redirect
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: devmap: provide rxq after redirect
rxq contains a pointer to the device from where
the redirect happened. Currently, the BPF program
that was executed after a redirect via BPF_MAP_TYPE_DEVMAP*
does not have it set.
This is particularly bad since accessing ingress_ifindex, e.g.
SEC("xdp")
int prog(struct xdp_md *pkt)
{
return bpf_redirect_map(&dev_redirect_map, 0, 0);
}
SEC("xdp/devmap")
int prog_after_redirect(struct xdp_md *pkt)
{
bpf_printk("ifindex %i", pkt->ingress_ifindex);
return XDP_PASS;
}
depends on access to rxq, so a NULL pointer gets dereferenced:
<1>[ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000
<1>[ 574.475188] #PF: supervisor read access in kernel mode
<1>[ 574.475194] #PF: error_code(0x0000) - not-present page
<6>[ 574.475199] PGD 0 P4D 0
<4>[ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
<4>[ 574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23
<4>[ 574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023
<4>[ 574.475231] Workqueue: mld mld_ifc_work
<4>[ 574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c
<4>[ 574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 <48> 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b
<4>[ 574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206
<4>[ 574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000
<4>[ 574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0
<4>[ 574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001
<4>[ 574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000
<4>[ 574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000
<4>[ 574.475289] FS: 0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000
<4>[ 574.475294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0
<4>[ 574.475303] PKRU: 55555554
<4>[ 574.475306] Call Trace:
<4>[ 574.475313] <IRQ>
<4>[ 574.475318] ? __die+0x23/0x70
<4>[ 574.475329] ? page_fault_oops+0x180/0x4c0
<4>[ 574.475339] ? skb_pp_cow_data+0x34c/0x490
<4>[ 574.475346] ? kmem_cache_free+0x257/0x280
<4>[ 574.475357] ? exc_page_fault+0x67/0x150
<4>[ 574.475368] ? asm_exc_page_fault+0x26/0x30
<4>[ 574.475381] ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c
<4>[ 574.475386] bq_xmit_all+0x158/0x420
<4>[ 574.475397] __dev_flush+0x30/0x90
<4>[ 574.475407] veth_poll+0x216/0x250 [veth]
<4>[ 574.475421] __napi_poll+0x28/0x1c0
<4>[ 574.475430] net_rx_action+0x32d/0x3a0
<4>[ 574.475441] handle_softirqs+0xcb/0x2c0
<4>[ 574.475451] do_softirq+0x40/0x60
<4>[ 574.475458] </IRQ>
<4>[ 574.475461] <TASK>
<4>[ 574.475464] __local_bh_enable_ip+0x66/0x70
<4>[ 574.475471] __dev_queue_xmit+0x268/0xe40
<4>[ 574.475480] ? selinux_ip_postroute+0x213/0x420
<4>[ 574.475491] ? alloc_skb_with_frags+0x4a/0x1d0
<4>[ 574.475502] ip6_finish_output2+0x2be/0x640
<4>[ 574.475512] ? nf_hook_slow+0x42/0xf0
<4>[ 574.475521] ip6_finish_output+0x194/0x300
<4>[ 574.475529] ? __pfx_ip6_finish_output+0x10/0x10
<4>[ 574.475538] mld_sendpack+0x17c/0x240
<4>[ 574.475548] mld_ifc_work+0x192/0x410
<4>[ 574.475557] process_one_work+0x15d/0x380
<4>[ 574.475566] worker_thread+0x29d/0x3a0
<4>[ 574.475573] ? __pfx_worker_thread+0x10/0x10
<4>[ 574.475580] ? __pfx_worker_thread+0x10/0x10
<4>[ 574.475587] kthread+0xcd/0x100
<4>[ 574.475597] ? __pfx_kthread+0x10/0x10
<4>[ 574.475606] ret_from_fork+0x31/0x50
<4>[ 574.475615] ? __pfx_kthread+0x10/0x10
<4>[ 574.475623] ret_from_fork_asm+0x1a/0x
---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在重定向后未提供rxq。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50162
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50162
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-50162 (4)
Same Patch Batch · Linux · 2024-11-07 · 34 CVEs total
| CVE-2024-50154 | 9.8 CRITICAL | tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). |
| CVE-2024-50152 | 9.8 CRITICAL | smb: client: fix possible double free in smb2_set_ea() |
| CVE-2024-50139 | 7.9 HIGH | KVM: arm64: Fix shift-out-of-bounds bug |
| CVE-2024-50150 | 7.8 HIGH | usb: typec: altmode should keep reference to parent |
| CVE-2024-50161 | 7.8 HIGH | bpf: Check the remaining info_cnt before repeating btf fields |
| CVE-2024-50158 | 7.8 HIGH | RDMA/bnxt_re: Fix out of bound check |
| CVE-2024-50164 | 7.8 HIGH | bpf: Fix overloading of MEM_UNINIT's meaning |
| CVE-2024-50165 | 7.8 HIGH | bpf: Preserve param->string when parsing mount options |
| CVE-2024-50151 | 7.8 HIGH | smb: client: fix OOBs when building SMB2_IOCTL request |
| CVE-2024-50149 | 7.8 HIGH | drm/xe: Don't free job in TDR |
| CVE-2024-50143 | 7.8 HIGH | udf: fix uninit-value use in udf_get_fileshortad |
| CVE-2024-50141 | 7.8 HIGH | ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context |
| CVE-2024-50145 | 7.5 HIGH | octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() |
| CVE-2024-50170 | 7.5 HIGH | net: bcmasp: fix potential memory leak in bcmasp_xmit() |
| CVE-2024-50159 | 7.0 HIGH | firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() |
| CVE-2024-50167 | be2net: fix potential memory leak in be_xmit() | |
| CVE-2024-50155 | netdevsim: use cond_resched() in nsim_dev_trap_report_work() | |
| CVE-2024-50168 | net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() | |
| CVE-2024-50169 | vsock: Update rx_bytes on read_skb() | |
| CVE-2024-50166 | fsl/fman: Fix refcount handling of fman-related devices |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-50162
No comments yet