GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-43840 (GCVE-0-2024-43840)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:21 – Updated: 2026-08-05 11:36
VLAI
Title
bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: efc9909fdce00a827a37609628223cd45bf95d0b , < 077149478497b2f00ff4fd9da2c892defa6418d8 (git)
Affected: efc9909fdce00a827a37609628223cd45bf95d0b , < d9664e6ff040798a46cdc5d401064f55b8676c83 (git)
Affected: efc9909fdce00a827a37609628223cd45bf95d0b , < 6d218fcc707d6b2c3616b6cd24b948fd4825cfec (git)
Affected: efc9909fdce00a827a37609628223cd45bf95d0b , < 19d3c179a37730caf600a97fed3794feac2b197b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.140 , ≤ 6.1.* (semver)
Unaffected: 6.6.92 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43840",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:07:58.806748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:04.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:30:44.552Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "077149478497b2f00ff4fd9da2c892defa6418d8",
              "status": "affected",
              "version": "efc9909fdce00a827a37609628223cd45bf95d0b",
              "versionType": "git"
            },
            {
              "lessThan": "d9664e6ff040798a46cdc5d401064f55b8676c83",
              "status": "affected",
              "version": "efc9909fdce00a827a37609628223cd45bf95d0b",
              "versionType": "git"
            },
            {
              "lessThan": "6d218fcc707d6b2c3616b6cd24b948fd4825cfec",
              "status": "affected",
              "version": "efc9909fdce00a827a37609628223cd45bf95d0b",
              "versionType": "git"
            },
            {
              "lessThan": "19d3c179a37730caf600a97fed3794feac2b197b",
              "status": "affected",
              "version": "efc9909fdce00a827a37609628223cd45bf95d0b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/net/bpf_jit_comp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\n\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\nthe struct bpf_tramp_image *im pointer as an argument in R0.\n\nThe trampoline generation code uses emit_addr_mov_i64() to emit\ninstructions for moving the bpf_tramp_image address into R0, but\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\nand uses only 48 bits. Because bpf_tramp_image is allocated using\nkzalloc(), its address can use more than 48-bits, in this case the\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\ncausing a kernel crash.\n\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\nas it can work with addresses that are greater than 48-bits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable trampoline is generated through the local `bpf()` syscall (BPF_PROG_LOAD + link attach of an fexit/fmod_ret tracing program); there is no network-reachable path to the arm64 JIT.\nAC:L - On an affected system the miscompilation is deterministic \u2014 `emit_addr_mov_i64()` unconditionally clobbers bits 48-63 of the kzalloc\u0027d `bpf_tramp_image` address, so every fexit/fmod_ret attach produces a broken trampoline that the attacker triggers simply by invoking the traced function. No race, timing window, or memory layout outside the attacker\u0027s influence is involved.\nPR:L - Loading and attaching a BPF_PROG_TYPE_TRACING program requires CAP_BPF plus CAP_PERFMON, which is a delegated non-root capability set commonly granted to unprivileged observability/container workloads and to userns-confined tasks via BPF tokens, not full administrative root.\nUI:N - The attacker loads the program, attaches it, and calls the traced kernel function entirely on its own; no victim action is needed.\nS:U - The wild pointer dereference and any resulting corruption occur within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `percpu_ref_get()` reads `ref-\u003epercpu_count_ptr` from a forged kernel address outside the intended object and treats the result as a live per-CPU pointer, and the broken image refcount can leave freed executable trampoline memory in use \u2014 memory corruption of this class is leverageable for kernel memory disclosure.\nI:H - After the wild read, `this_cpu_add(*percpu_count, 1)` (or `atomic_long_add(\u0026ref-\u003edata-\u003ecount)`) performs a read-modify-write through the garbage value, an uncontrolled kernel memory write; additionally the trampoline\u0027s liveness refcount is taken on the wrong object, permitting use-after-free of the JIT\u0027d executable image.\nA:H - The forged address lands far outside mapped linear memory, so the first invocation of the traced function takes an unhandled kernel paging fault (oops/panic, possibly in atomic or softirq context), and the poisoned trampoline remains installed so every later call to that function faults again."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:42.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/077149478497b2f00ff4fd9da2c892defa6418d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9664e6ff040798a46cdc5d401064f55b8676c83"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b"
        }
      ],
      "title": "bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43840",
    "datePublished": "2024-08-17T09:21:55.841Z",
    "dateReserved": "2024-08-17T09:11:59.274Z",
    "dateUpdated": "2026-08-05T11:36:42.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43840",
      "date": "2026-09-16",
      "epss": "0.00215",
      "percentile": "0.12079"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.10.3\", \"matchCriteriaId\": \"10A3C375-FFAF-4092-9FFF-0DE81E7DCE63\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\\n\\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\\nthe struct bpf_tramp_image *im pointer as an argument in R0.\\n\\nThe trampoline generation code uses emit_addr_mov_i64() to emit\\ninstructions for moving the bpf_tramp_image address into R0, but\\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\\nand uses only 48 bits. Because bpf_tramp_image is allocated using\\nkzalloc(), its address can use more than 48-bits, in this case the\\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\\ncausing a kernel crash.\\n\\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\\nas it can work with addresses that are greater than 48-bits.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, arm64: Reparar trampol\\u00edn para BPF_TRAMP_F_CALL_ORIG Cuando BPF_TRAMP_F_CALL_ORIG est\\u00e1 configurado, el trampol\\u00edn llama a las funciones __bpf_tramp_enter() y __bpf_tramp_exit(), pas\\u00e1ndoles el puntero struct bpf_tramp_image *im como argumento en R0 . El c\\u00f3digo de generaci\\u00f3n de trampol\\u00edn usa emit_addr_mov_i64() para emitir instrucciones para mover la direcci\\u00f3n bpf_tramp_image a R0, pero emit_addr_mov_i64() asume que la direcci\\u00f3n est\\u00e1 en el espacio vmalloc() y usa solo 48 bits. Debido a que bpf_tramp_image se asigna usando kzalloc(), su direcci\\u00f3n puede usar m\\u00e1s de 48 bits, en este caso el trampol\\u00edn pasar\\u00e1 una direcci\\u00f3n no v\\u00e1lida a __bpf_tramp_enter/exit() provocando un bloqueo del kernel. Solucione este problema utilizando emit_a64_mov_i64() en lugar de emit_addr_mov_i64(), ya que puede funcionar con direcciones superiores a 48 bits.\"}]",
      "id": "CVE-2024-43840",
      "lastModified": "2024-10-29T16:25:29.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-17T10:15:09.517",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43840\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T10:15:09.517\",\"lastModified\":\"2026-08-04T11:19:53.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\\n\\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\\nthe struct bpf_tramp_image *im pointer as an argument in R0.\\n\\nThe trampoline generation code uses emit_addr_mov_i64() to emit\\ninstructions for moving the bpf_tramp_image address into R0, but\\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\\nand uses only 48 bits. Because bpf_tramp_image is allocated using\\nkzalloc(), its address can use more than 48-bits, in this case the\\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\\ncausing a kernel crash.\\n\\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\\nas it can work with addresses that are greater than 48-bits.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, arm64: Reparar trampol\u00edn para BPF_TRAMP_F_CALL_ORIG Cuando BPF_TRAMP_F_CALL_ORIG est\u00e1 configurado, el trampol\u00edn llama a las funciones __bpf_tramp_enter() y __bpf_tramp_exit(), pas\u00e1ndoles el puntero struct bpf_tramp_image *im como argumento en R0 . El c\u00f3digo de generaci\u00f3n de trampol\u00edn usa emit_addr_mov_i64() para emitir instrucciones para mover la direcci\u00f3n bpf_tramp_image a R0, pero emit_addr_mov_i64() asume que la direcci\u00f3n est\u00e1 en el espacio vmalloc() y usa solo 48 bits. Debido a que bpf_tramp_image se asigna usando kzalloc(), su direcci\u00f3n puede usar m\u00e1s de 48 bits, en este caso el trampol\u00edn pasar\u00e1 una direcci\u00f3n no v\u00e1lida a __bpf_tramp_enter/exit() provocando un bloqueo del kernel. Solucione este problema utilizando emit_a64_mov_i64() en lugar de emit_addr_mov_i64(), ya que puede funcionar con direcciones superiores a 48 bits.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"efc9909fdce00a827a37609628223cd45bf95d0b\",\"lessThan\":\"077149478497b2f00ff4fd9da2c892defa6418d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"efc9909fdce00a827a37609628223cd45bf95d0b\",\"lessThan\":\"d9664e6ff040798a46cdc5d401064f55b8676c83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"efc9909fdce00a827a37609628223cd45bf95d0b\",\"lessThan\":\"6d218fcc707d6b2c3616b6cd24b948fd4825cfec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"efc9909fdce00a827a37609628223cd45bf95d0b\",\"lessThan\":\"19d3c179a37730caf600a97fed3794feac2b197b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/net/bpf_jit_comp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.140\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.92\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:07:58.806748Z\",\"id\":\"CVE-2024-43840\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"10A3C375-FFAF-4092-9FFF-0DE81E7DCE63\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/077149478497b2f00ff4fd9da2c892defa6418d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d9664e6ff040798a46cdc5d401064f55b8676c83\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:42:03+00:00",
      "cve": "CVE-2024-43840",
      "id": "CVE-2024-43840",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43840.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:27:14Z",
      "cve": "CVE-2024-43840",
      "id": "CVE-2024-43840",
      "initial_release_date": "2024-08-18T02:01:39Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "322",
      "product_status:recommended": "355",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43840",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43840.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:30:44.552Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43840\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:07:58.806748Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.203Z\"}}], \"cna\": {\"title\": \"bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable trampoline is generated through the local `bpf()` syscall (BPF_PROG_LOAD + link attach of an fexit/fmod_ret tracing program); there is no network-reachable path to the arm64 JIT.\\nAC:L - On an affected system the miscompilation is deterministic \\u2014 `emit_addr_mov_i64()` unconditionally clobbers bits 48-63 of the kzalloc\u0027d `bpf_tramp_image` address, so every fexit/fmod_ret attach produces a broken trampoline that the attacker triggers simply by invoking the traced function. No race, timing window, or memory layout outside the attacker\u0027s influence is involved.\\nPR:L - Loading and attaching a BPF_PROG_TYPE_TRACING program requires CAP_BPF plus CAP_PERFMON, which is a delegated non-root capability set commonly granted to unprivileged observability/container workloads and to userns-confined tasks via BPF tokens, not full administrative root.\\nUI:N - The attacker loads the program, attaches it, and calls the traced kernel function entirely on its own; no victim action is needed.\\nS:U - The wild pointer dereference and any resulting corruption occur within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `percpu_ref_get()` reads `ref-\u003epercpu_count_ptr` from a forged kernel address outside the intended object and treats the result as a live per-CPU pointer, and the broken image refcount can leave freed executable trampoline memory in use \\u2014 memory corruption of this class is leverageable for kernel memory disclosure.\\nI:H - After the wild read, `this_cpu_add(*percpu_count, 1)` (or `atomic_long_add(\u0026ref-\u003edata-\u003ecount)`) performs a read-modify-write through the garbage value, an uncontrolled kernel memory write; additionally the trampoline\u0027s liveness refcount is taken on the wrong object, permitting use-after-free of the JIT\u0027d executable image.\\nA:H - The forged address lands far outside mapped linear memory, so the first invocation of the traced function takes an unhandled kernel paging fault (oops/panic, possibly in atomic or softirq context), and the poisoned trampoline remains installed so every later call to that function faults again.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"efc9909fdce00a827a37609628223cd45bf95d0b\", \"lessThan\": \"077149478497b2f00ff4fd9da2c892defa6418d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"efc9909fdce00a827a37609628223cd45bf95d0b\", \"lessThan\": \"d9664e6ff040798a46cdc5d401064f55b8676c83\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"efc9909fdce00a827a37609628223cd45bf95d0b\", \"lessThan\": \"6d218fcc707d6b2c3616b6cd24b948fd4825cfec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"efc9909fdce00a827a37609628223cd45bf95d0b\", \"lessThan\": \"19d3c179a37730caf600a97fed3794feac2b197b\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm64/net/bpf_jit_comp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.140\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.92\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm64/net/bpf_jit_comp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/077149478497b2f00ff4fd9da2c892defa6418d8\"}, {\"url\": \"https://git.kernel.org/stable/c/d9664e6ff040798a46cdc5d401064f55b8676c83\"}, {\"url\": \"https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec\"}, {\"url\": \"https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG\\n\\nWhen BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls\\n__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them\\nthe struct bpf_tramp_image *im pointer as an argument in R0.\\n\\nThe trampoline generation code uses emit_addr_mov_i64() to emit\\ninstructions for moving the bpf_tramp_image address into R0, but\\nemit_addr_mov_i64() assumes the address to be in the vmalloc() space\\nand uses only 48 bits. Because bpf_tramp_image is allocated using\\nkzalloc(), its address can use more than 48-bits, in this case the\\ntrampoline will pass an invalid address to __bpf_tramp_enter/exit()\\ncausing a kernel crash.\\n\\nFix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()\\nas it can work with addresses that are greater than 48-bits.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.140\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.92\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:36:42.708Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43840\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:36:42.708Z\", \"dateReserved\": \"2024-08-17T09:11:59.274Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:21:55.841Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.