GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-46754 (GCVE-0-2024-46754)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-09-02 12:49
VLAI
Title
bpf: Remove tst_run from lwt_seg6local_prog_ops.
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tst_run from lwt_seg6local_prog_ops. The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 14:46 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < ea3fae6984ba0f054550e4da22219489c12cd8d4 (git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < a675524cfbe88fd49c05ff8807a08646983e687c (git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a (git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < e217492f6fa2228ad703ee3006d8fc4e5969fbd4 (git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 9cd15511de7c619bbd0f54bb3f28e6e720ded5d6 (git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < c13fda93aca118b8e5cd202e339046728ee7dddb (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.269 , ≤ 5.10.* (semver)
Unaffected: 5.15.220 , ≤ 5.15.* (semver)
Unaffected: 6.1.187 , ≤ 6.1.* (semver)
Unaffected: 6.6.156 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:46:48.262114Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:47:03.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea3fae6984ba0f054550e4da22219489c12cd8d4",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            },
            {
              "lessThan": "a675524cfbe88fd49c05ff8807a08646983e687c",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            },
            {
              "lessThan": "b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            },
            {
              "lessThan": "e217492f6fa2228ad703ee3006d8fc4e5969fbd4",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            },
            {
              "lessThan": "9cd15511de7c619bbd0f54bb3f28e6e720ded5d6",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            },
            {
              "lessThan": "c13fda93aca118b8e5cd202e339046728ee7dddb",
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.269",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\n\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\n\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn\u0027t work since it was introduced in commit 04d4b274e2a\n(\"ipv6: sr: Add seg6local action End.BPF\"). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\n\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is the local `bpf(BPF_PROG_TEST_RUN)` syscall against a `BPF_PROG_TYPE_LWT_SEG6LOCAL` program fd; no packet ever reaches this path from the network, since real SRv6 traffic goes through `input_action_end_bpf()` which initializes the state correctly.\nAC:L - A single `BPF_PROG_TEST_RUN` calling `bpf_lwt_seg6_action(END_B6_ENCAP)` deterministically hits `dev_net(skb_dst(skb)-\u003edev)` with a NULL dst, with no race, no timing window and no layout luck; the UAF variant needs only ordinary heap grooming that the attacker fully drives by choosing `data_size_in` (slab cache), `srhoff` (offset) and CPU affinity.\nPR:L - `bpf_prog_test_run()` itself performs zero capability check \u2014 it only does `bpf_prog_get(attr-\u003etest.prog_fd)` \u2014 so any unprivileged local process that inherits or receives a seg6local program fd (fork/exec, `SCM_RIGHTS`, or a permissively-moded bpffs pin) can trigger it, and BPF tokens in 6.9+ deliberately delegate `CAP_BPF`/`CAP_NET_ADMIN` program loading to unprivileged users inside containers.\nUI:N - The attacker issues the `bpf()` syscalls entirely on their own; no victim action, mount, file open, or administrator step is involved at any point.\nS:U - The NULL dereference, out-of-bounds read and slab use-after-free all occur in kernel context within the same security authority the calling process already interacts with; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling per-CPU `srh_state-\u003esrh` lets `seg6_validate_srh()` walk TLVs through a freed, attacker-reclaimed slab object, and `seg6_do_srh_inline()`\u0027s `memmove(hdr, oldhdr, 40)` on a short test packet reads up to 40 bytes past `skb-\u003etail` which are then returned to userspace via `bpf_test_finish()`\u0027s `data_out`.\nI:H - `seg6_bpf_has_valid_srh()` executes `srh-\u003ehdrlen = (u8)(srh_state-\u003ehdrlen \u003e\u003e 3)` through the stale pointer, giving an attacker-valued one-byte write at an attacker-chosen offset inside a freed object in an attacker-selected kmalloc cache \u2014 a reclaim primitive suitable for corrupting length/flag fields of a sprayed victim structure and escalating.\nA:H - `bpf_lwt_seg6_action(END_B6_ENCAP)` reliably oopses the kernel on `dev_net(skb_dst(skb)-\u003edev)` because the test skb carries no dst, and post-`d1542d4ae4df` the same path also trips `lockdep_assert_held()`, which is a panic under `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:13.346Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea3fae6984ba0f054550e4da22219489c12cd8d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a675524cfbe88fd49c05ff8807a08646983e687c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb"
        }
      ],
      "title": "bpf: Remove tst_run from lwt_seg6local_prog_ops.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46754",
    "datePublished": "2024-09-18T07:12:13.780Z",
    "dateReserved": "2024-09-11T15:12:18.270Z",
    "dateUpdated": "2026-09-02T12:49:13.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46754",
      "date": "2026-09-16",
      "epss": "0.00247",
      "percentile": "0.16189"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\\n\\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\\nvia bpf_test_run() without without entering input_action_end_bpf()\\nfirst.\\n\\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\\nprobably didn\u0027t work since it was introduced in commit 04d4b274e2a\\n(\\\"ipv6: sr: Add seg6local action End.BPF\\\"). The reason is that the\\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\\ntest case but each BPF function expects it.\\n\\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: eliminar tst_run de lwt_seg6local_prog_ops. El syzbot inform\\u00f3 que las operaciones BPF relacionadas con lwt_seg6 se pueden invocar mediante bpf_test_run() sin ingresar primero input_action_end_bpf(). Martin KaFai Lau dijo que la autoprueba para BPF_PROG_TYPE_LWT_SEG6LOCAL probablemente no funcion\\u00f3 ya que se introdujo en el commit 04d4b274e2a (\\\"ipv6: sr: Agregar acci\\u00f3n seg6local End.BPF\\\"). La raz\\u00f3n es que la variable por CPU seg6_bpf_srh_states::srh nunca se asigna en el caso de la autoprueba, pero cada funci\\u00f3n BPF lo espera. Eliminar test_run para BPF_PROG_TYPE_LWT_SEG6LOCAL.\"}]",
      "id": "CVE-2024-46754",
      "lastModified": "2024-09-20T12:30:51.220",
      "published": "2024-09-18T08:15:04.153",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:50:58.000Z",
      "cve": "CVE-2024-46754",
      "id": "msrc_CVE-2024-46754",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Remove tst_run from lwt_seg6local_prog_ops.",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46754.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46754\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:04.153\",\"lastModified\":\"2026-09-02T13:16:48.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\\n\\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\\nvia bpf_test_run() without without entering input_action_end_bpf()\\nfirst.\\n\\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\\nprobably didn\u0027t work since it was introduced in commit 04d4b274e2a\\n(\\\"ipv6: sr: Add seg6local action End.BPF\\\"). The reason is that the\\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\\ntest case but each BPF function expects it.\\n\\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: eliminar tst_run de lwt_seg6local_prog_ops. El syzbot inform\u00f3 que las operaciones BPF relacionadas con lwt_seg6 se pueden invocar mediante bpf_test_run() sin ingresar primero input_action_end_bpf(). Martin KaFai Lau dijo que la autoprueba para BPF_PROG_TYPE_LWT_SEG6LOCAL probablemente no funcion\u00f3 ya que se introdujo en el commit 04d4b274e2a (\\\"ipv6: sr: Agregar acci\u00f3n seg6local End.BPF\\\"). La raz\u00f3n es que la variable por CPU seg6_bpf_srh_states::srh nunca se asigna en el caso de la autoprueba, pero cada funci\u00f3n BPF lo espera. Eliminar test_run para BPF_PROG_TYPE_LWT_SEG6LOCAL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"ea3fae6984ba0f054550e4da22219489c12cd8d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"a675524cfbe88fd49c05ff8807a08646983e687c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"e217492f6fa2228ad703ee3006d8fc4e5969fbd4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"9cd15511de7c619bbd0f54bb3f28e6e720ded5d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\"lessThan\":\"c13fda93aca118b8e5cd202e339046728ee7dddb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/filter.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.269\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.220\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.187\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.156\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:46:48.262114Z\",\"id\":\"CVE-2024-46754\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"1A5E25C4-1AB9-41C9-88CF-A493EE371276\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a675524cfbe88fd49c05ff8807a08646983e687c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea3fae6984ba0f054550e4da22219489c12cd8d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T09:11:30+00:00",
      "cve": "CVE-2024-46754",
      "id": "CVE-2024-46754",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46754.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:09:13Z",
      "cve": "CVE-2024-46754",
      "id": "CVE-2024-46754",
      "initial_release_date": "2024-09-19T03:10:32Z",
      "product_status:known_affected": "514",
      "product_status:known_not_affected": "203",
      "product_status:recommended": "675",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46754",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46754.json",
      "version": "70"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46754\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:46:48.262114Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:46:52.341Z\"}}], \"cna\": {\"title\": \"bpf: Remove tst_run from lwt_seg6local_prog_ops.\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The only entry point is the local `bpf(BPF_PROG_TEST_RUN)` syscall against a `BPF_PROG_TYPE_LWT_SEG6LOCAL` program fd; no packet ever reaches this path from the network, since real SRv6 traffic goes through `input_action_end_bpf()` which initializes the state correctly.\\nAC:L - A single `BPF_PROG_TEST_RUN` calling `bpf_lwt_seg6_action(END_B6_ENCAP)` deterministically hits `dev_net(skb_dst(skb)-\u003edev)` with a NULL dst, with no race, no timing window and no layout luck; the UAF variant needs only ordinary heap grooming that the attacker fully drives by choosing `data_size_in` (slab cache), `srhoff` (offset) and CPU affinity.\\nPR:L - `bpf_prog_test_run()` itself performs zero capability check \\u2014 it only does `bpf_prog_get(attr-\u003etest.prog_fd)` \\u2014 so any unprivileged local process that inherits or receives a seg6local program fd (fork/exec, `SCM_RIGHTS`, or a permissively-moded bpffs pin) can trigger it, and BPF tokens in 6.9+ deliberately delegate `CAP_BPF`/`CAP_NET_ADMIN` program loading to unprivileged users inside containers.\\nUI:N - The attacker issues the `bpf()` syscalls entirely on their own; no victim action, mount, file open, or administrator step is involved at any point.\\nS:U - The NULL dereference, out-of-bounds read and slab use-after-free all occur in kernel context within the same security authority the calling process already interacts with; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The dangling per-CPU `srh_state-\u003esrh` lets `seg6_validate_srh()` walk TLVs through a freed, attacker-reclaimed slab object, and `seg6_do_srh_inline()`\u0027s `memmove(hdr, oldhdr, 40)` on a short test packet reads up to 40 bytes past `skb-\u003etail` which are then returned to userspace via `bpf_test_finish()`\u0027s `data_out`.\\nI:H - `seg6_bpf_has_valid_srh()` executes `srh-\u003ehdrlen = (u8)(srh_state-\u003ehdrlen \u003e\u003e 3)` through the stale pointer, giving an attacker-valued one-byte write at an attacker-chosen offset inside a freed object in an attacker-selected kmalloc cache \\u2014 a reclaim primitive suitable for corrupting length/flag fields of a sprayed victim structure and escalating.\\nA:H - `bpf_lwt_seg6_action(END_B6_ENCAP)` reliably oopses the kernel on `dev_net(skb_dst(skb)-\u003edev)` because the test skb carries no dst, and post-`d1542d4ae4df` the same path also trips `lockdep_assert_held()`, which is a panic under `panic_on_warn`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"ea3fae6984ba0f054550e4da22219489c12cd8d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"a675524cfbe88fd49c05ff8807a08646983e687c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"e217492f6fa2228ad703ee3006d8fc4e5969fbd4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"9cd15511de7c619bbd0f54bb3f28e6e720ded5d6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\", \"lessThan\": \"c13fda93aca118b8e5cd202e339046728ee7dddb\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/filter.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.220\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.187\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.156\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/filter.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ea3fae6984ba0f054550e4da22219489c12cd8d4\"}, {\"url\": \"https://git.kernel.org/stable/c/a675524cfbe88fd49c05ff8807a08646983e687c\"}, {\"url\": \"https://git.kernel.org/stable/c/b05c2e25a5c168dbb46b6f7fcb741fd4e4f3b54a\"}, {\"url\": \"https://git.kernel.org/stable/c/e217492f6fa2228ad703ee3006d8fc4e5969fbd4\"}, {\"url\": \"https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6\"}, {\"url\": \"https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\\n\\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\\nvia bpf_test_run() without without entering input_action_end_bpf()\\nfirst.\\n\\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\\nprobably didn\u0027t work since it was introduced in commit 04d4b274e2a\\n(\\\"ipv6: sr: Add seg6local action End.BPF\\\"). The reason is that the\\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\\ntest case but each BPF function expects it.\\n\\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.269\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.220\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.187\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.156\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-09-02T12:49:13.346Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46754\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-02T12:49:13.346Z\", \"dateReserved\": \"2024-09-11T15:12:18.270Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:13.780Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.