CVE-2024-50161 (GCVE-0-2024-50161)

Vulnerability from cvelistv5 – Published: 2024-11-07 09:31 – Updated: 2026-08-05 11:42
VLAI
Title
bpf: Check the remaining info_cnt before repeating btf fields
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check the remaining info_cnt before repeating btf fields When trying to repeat the btf fields for array of nested struct, it doesn't check the remaining info_cnt. The following splat will be reported when the value of ret * nelems is greater than BTF_FIELDS_MAX: ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49 index 11 is out of range for type 'btf_field_info [11]' CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Call Trace: <TASK> dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_out_of_bounds+0x6f/0x80 ? kallsyms_lookup_name+0x48/0xb0 btf_parse_fields+0x992/0xce0 map_create+0x591/0x770 __sys_bpf+0x229/0x2410 __x64_sys_bpf+0x1f/0x30 x64_sys_call+0x199/0x9f0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fea56f2cc5d ...... </TASK> ---[ end trace ]--- Fix it by checking the remaining info_cnt in btf_repeat_fields() before repeating the btf fields.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:20 UTC
CWE
  • CWE-129 - Improper Validation of Array Index
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 64e8ee814819f21beeeda00d4119221443d77992 , < 6f957d972feee9b385ea3ae6530310a84e55ba71 (git)
Affected: 64e8ee814819f21beeeda00d4119221443d77992 , < 797d73ee232dd1833dec4824bc53a22032e97c1c (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:20:20.703840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-129",
                "description": "CWE-129 Improper Validation of Array Index",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:12.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f957d972feee9b385ea3ae6530310a84e55ba71",
              "status": "affected",
              "version": "64e8ee814819f21beeeda00d4119221443d77992",
              "versionType": "git"
            },
            {
              "lessThan": "797d73ee232dd1833dec4824bc53a22032e97c1c",
              "status": "affected",
              "version": "64e8ee814819f21beeeda00d4119221443d77992",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check the remaining info_cnt before repeating btf fields\n\nWhen trying to repeat the btf fields for array of nested struct, it\ndoesn\u0027t check the remaining info_cnt. The following splat will be\nreported when the value of ret * nelems is greater than BTF_FIELDS_MAX:\n\n  ------------[ cut here ]------------\n  UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49\n  index 11 is out of range for type \u0027btf_field_info [11]\u0027\n  CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1\n  Tainted: [O]=OOT_MODULE\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x57/0x70\n   dump_stack+0x10/0x20\n   ubsan_epilogue+0x9/0x40\n   __ubsan_handle_out_of_bounds+0x6f/0x80\n   ? kallsyms_lookup_name+0x48/0xb0\n   btf_parse_fields+0x992/0xce0\n   map_create+0x591/0x770\n   __sys_bpf+0x229/0x2410\n   __x64_sys_bpf+0x1f/0x30\n   x64_sys_call+0x199/0x9f0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7fea56f2cc5d\n  ......\n   \u003c/TASK\u003e\n  ---[ end trace ]---\n\nFix it by checking the remaining info_cnt in btf_repeat_fields() before\nrepeating the btf fields."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through the local `bpf()` syscall \u2014 `BPF_MAP_CREATE` with an attacker-supplied BTF fd (`map_check_btf` \u2192 `btf_parse_fields`) or `BPF_PROG_LOAD` via `btf_parse_struct_metas()`. No network, adjacent, or physical path reaches BTF field parsing.\nAC:L - The attacker crafts the entire BTF blob offline \u2014 an array of `nelems` nested structs each holding a kptr/list_head \u2014 and the OOB write fires deterministically on the first syscall with no race to win and no condition outside the attacker\u0027s control. `nelems` directly selects how far past the 11-entry buffer the `memcpy` runs, so the attacker chooses between a precise caller-frame overwrite and a stack-destroying blowout.\nPR:L - `BPF_BTF_LOAD` and privileged map types gate on `bpf_token_capable(token, CAP_BPF)`, which falls back to `ns_capable(token-\u003euserns, CAP_BPF)` \u2014 so an unprivileged process holding a delegated BPF token, the mechanism built expressly for containers, reaches this path, and CAP_BPF is routinely granted to non-root observability/networking agents rather than being init-namespace root. Consistent with kernel CNA precedent for CAP_BPF-gated bugs (CVE-2025-21867, CVE-2024-53099), Low is the appropriate and higher-severity choice.\nUI:N - The attacker performs every step inside its own process \u2014 load the crafted BTF, then issue `BPF_MAP_CREATE` or `BPF_PROG_LOAD`. No victim action, mount, privileged helper, or file open is involved.\nS:U - The corrupted kernel stack and any resulting code execution stay within the kernel of the running system, the same security authority that manages the attacking process. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted `btf_field_info` slots are read straight back by `btf_parse_fields`, and `btf_parse_graph_root()` dereferences `info-\u003egraph_root.node_name` through `strcmp()`, turning an attacker-influenced stack slot into an arbitrary kernel-pointer read. More broadly, a controlled-length stack overflow into live caller frames is leverageable for arbitrary kernel memory disclosure.\nI:H - This is a genuine out-of-bounds write past a 264-byte kernel-stack buffer, with attacker-chosen length and semi-controlled 24-byte payloads containing attacker-supplied u32 offsets/type-ids and real kernel pointers. It overwrites saved registers, return addresses, and live caller-frame pointers (`map`, `btf`, `token`, `rec`) that are subsequently dereferenced and freed, yielding a control-flow-hijack / arbitrary-write primitive \u2014 and on builds without CONFIG_STACKPROTECTOR, direct return-address control.\nA:H - Even the minimal reported case corrupts the kernel stack (caught only incidentally by UBSAN), and since `nelems` is bounded only by `nelems * elem_size \u003c= U32_MAX` the write can run hundreds of megabytes past the buffer, guaranteeing a stack-protector panic or guard-page fault. Any local caller with the required token can trigger this repeatedly for immediate, reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:10.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71"
        },
        {
          "url": "https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c"
        }
      ],
      "title": "bpf: Check the remaining info_cnt before repeating btf fields",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50161",
    "datePublished": "2024-11-07T09:31:38.118Z",
    "dateReserved": "2024-10-21T19:36:19.961Z",
    "dateUpdated": "2026-08-05T11:42:10.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50161",
      "date": "2026-08-13",
      "epss": "0.00201",
      "percentile": "0.10162"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.6\", \"matchCriteriaId\": \"35973F0F-C32F-4D88-B0FE-C75F65A0002B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check the remaining info_cnt before repeating btf fields\\n\\nWhen trying to repeat the btf fields for array of nested struct, it\\ndoesn\u0027t check the remaining info_cnt. The following splat will be\\nreported when the value of ret * nelems is greater than BTF_FIELDS_MAX:\\n\\n  ------------[ cut here ]------------\\n  UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49\\n  index 11 is out of range for type \u0027btf_field_info [11]\u0027\\n  CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1\\n  Tainted: [O]=OOT_MODULE\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x57/0x70\\n   dump_stack+0x10/0x20\\n   ubsan_epilogue+0x9/0x40\\n   __ubsan_handle_out_of_bounds+0x6f/0x80\\n   ? kallsyms_lookup_name+0x48/0xb0\\n   btf_parse_fields+0x992/0xce0\\n   map_create+0x591/0x770\\n   __sys_bpf+0x229/0x2410\\n   __x64_sys_bpf+0x1f/0x30\\n   x64_sys_call+0x199/0x9f0\\n   do_syscall_64+0x3b/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n  RIP: 0033:0x7fea56f2cc5d\\n  ......\\n   \u003c/TASK\u003e\\n  ---[ end trace ]---\\n\\nFix it by checking the remaining info_cnt in btf_repeat_fields() before\\nrepeating the btf fields.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Verificar el info_cnt restante antes de repetir los campos btf Al intentar repetir los campos btf para una matriz de estructuras anidadas, no verifica el info_cnt restante. Se informar\\u00e1 el siguiente error cuando el valor de ret * nelems sea mayor que BTF_FIELDS_MAX: ------------[ cortar aqu\\u00ed ]------------ UBSAN: array-index-out-of-bounds en ../kernel/bpf/btf.c:3951:49 el \\u00edndice 11 est\\u00e1 fuera de rango para el tipo \u0027btf_field_info [11]\u0027 CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1 Tainted: [O]=OOT_MODULE Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Seguimiento de llamadas:  dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_fuera_de_l\\u00edmites+0x6f/0x80 ? kallsyms_lookup_name+0x48/0xb0 btf_parse_fields+0x992/0xce0 map_create+0x591/0x770 __sys_bpf+0x229/0x2410 __x64_sys_bpf+0x1f/0x30 x64_sys_call+0x199/0x9f0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fea56f2cc5d ......  ---[ fin del seguimiento ]--- Arr\\u00e9glelo comprobando el info_cnt restante en btf_repeat_fields() antes de repetir los campos btf.\"}]",
      "id": "CVE-2024-50161",
      "lastModified": "2024-11-13T16:36:57.413",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-07T10:15:07.480",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-129\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50161\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-07T10:15:07.480\",\"lastModified\":\"2026-08-04T11:21:26.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check the remaining info_cnt before repeating btf fields\\n\\nWhen trying to repeat the btf fields for array of nested struct, it\\ndoesn\u0027t check the remaining info_cnt. The following splat will be\\nreported when the value of ret * nelems is greater than BTF_FIELDS_MAX:\\n\\n  ------------[ cut here ]------------\\n  UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49\\n  index 11 is out of range for type \u0027btf_field_info [11]\u0027\\n  CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1\\n  Tainted: [O]=OOT_MODULE\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x57/0x70\\n   dump_stack+0x10/0x20\\n   ubsan_epilogue+0x9/0x40\\n   __ubsan_handle_out_of_bounds+0x6f/0x80\\n   ? kallsyms_lookup_name+0x48/0xb0\\n   btf_parse_fields+0x992/0xce0\\n   map_create+0x591/0x770\\n   __sys_bpf+0x229/0x2410\\n   __x64_sys_bpf+0x1f/0x30\\n   x64_sys_call+0x199/0x9f0\\n   do_syscall_64+0x3b/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n  RIP: 0033:0x7fea56f2cc5d\\n  ......\\n   \u003c/TASK\u003e\\n  ---[ end trace ]---\\n\\nFix it by checking the remaining info_cnt in btf_repeat_fields() before\\nrepeating the btf fields.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Verificar el info_cnt restante antes de repetir los campos btf Al intentar repetir los campos btf para una matriz de estructuras anidadas, no verifica el info_cnt restante. Se informar\u00e1 el siguiente error cuando el valor de ret * nelems sea mayor que BTF_FIELDS_MAX: ------------[ cortar aqu\u00ed ]------------ UBSAN: array-index-out-of-bounds en ../kernel/bpf/btf.c:3951:49 el \u00edndice 11 est\u00e1 fuera de rango para el tipo \u0027btf_field_info [11]\u0027 CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1 Tainted: [O]=OOT_MODULE Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Seguimiento de llamadas:  dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_fuera_de_l\u00edmites+0x6f/0x80 ? kallsyms_lookup_name+0x48/0xb0 btf_parse_fields+0x992/0xce0 map_create+0x591/0x770 __sys_bpf+0x229/0x2410 __x64_sys_bpf+0x1f/0x30 x64_sys_call+0x199/0x9f0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fea56f2cc5d ......  ---[ fin del seguimiento ]--- Arr\u00e9glelo comprobando el info_cnt restante en btf_repeat_fields() antes de repetir los campos btf.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/btf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"64e8ee814819f21beeeda00d4119221443d77992\",\"lessThan\":\"6f957d972feee9b385ea3ae6530310a84e55ba71\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64e8ee814819f21beeeda00d4119221443d77992\",\"lessThan\":\"797d73ee232dd1833dec4824bc53a22032e97c1c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/btf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:20:20.703840Z\",\"id\":\"CVE-2024-50161\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"35973F0F-C32F-4D88-B0FE-C75F65A0002B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:44+00:00",
      "cve": "CVE-2024-50161",
      "id": "CVE-2024-50161",
      "initial_release_date": "2024-11-07T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Check the remaining info_cnt before repeating btf fields",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50161.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:50:58Z",
      "cve": "CVE-2024-50161",
      "id": "CVE-2024-50161",
      "initial_release_date": "2024-11-08T03:48:52Z",
      "product_status:known_not_affected": "378",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50161",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50161.json",
      "version": "22"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50161\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:20:20.703840Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-129\", \"description\": \"CWE-129 Improper Validation of Array Index\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:18:29.932Z\"}}], \"cna\": {\"title\": \"bpf: Check the remaining info_cnt before repeating btf fields\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The overflow is reached only through the local `bpf()` syscall \\u2014 `BPF_MAP_CREATE` with an attacker-supplied BTF fd (`map_check_btf` \\u2192 `btf_parse_fields`) or `BPF_PROG_LOAD` via `btf_parse_struct_metas()`. No network, adjacent, or physical path reaches BTF field parsing.\\nAC:L - The attacker crafts the entire BTF blob offline \\u2014 an array of `nelems` nested structs each holding a kptr/list_head \\u2014 and the OOB write fires deterministically on the first syscall with no race to win and no condition outside the attacker\u0027s control. `nelems` directly selects how far past the 11-entry buffer the `memcpy` runs, so the attacker chooses between a precise caller-frame overwrite and a stack-destroying blowout.\\nPR:L - `BPF_BTF_LOAD` and privileged map types gate on `bpf_token_capable(token, CAP_BPF)`, which falls back to `ns_capable(token-\u003euserns, CAP_BPF)` \\u2014 so an unprivileged process holding a delegated BPF token, the mechanism built expressly for containers, reaches this path, and CAP_BPF is routinely granted to non-root observability/networking agents rather than being init-namespace root. Consistent with kernel CNA precedent for CAP_BPF-gated bugs (CVE-2025-21867, CVE-2024-53099), Low is the appropriate and higher-severity choice.\\nUI:N - The attacker performs every step inside its own process \\u2014 load the crafted BTF, then issue `BPF_MAP_CREATE` or `BPF_PROG_LOAD`. No victim action, mount, privileged helper, or file open is involved.\\nS:U - The corrupted kernel stack and any resulting code execution stay within the kernel of the running system, the same security authority that manages the attacking process. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - The corrupted `btf_field_info` slots are read straight back by `btf_parse_fields`, and `btf_parse_graph_root()` dereferences `info-\u003egraph_root.node_name` through `strcmp()`, turning an attacker-influenced stack slot into an arbitrary kernel-pointer read. More broadly, a controlled-length stack overflow into live caller frames is leverageable for arbitrary kernel memory disclosure.\\nI:H - This is a genuine out-of-bounds write past a 264-byte kernel-stack buffer, with attacker-chosen length and semi-controlled 24-byte payloads containing attacker-supplied u32 offsets/type-ids and real kernel pointers. It overwrites saved registers, return addresses, and live caller-frame pointers (`map`, `btf`, `token`, `rec`) that are subsequently dereferenced and freed, yielding a control-flow-hijack / arbitrary-write primitive \\u2014 and on builds without CONFIG_STACKPROTECTOR, direct return-address control.\\nA:H - Even the minimal reported case corrupts the kernel stack (caught only incidentally by UBSAN), and since `nelems` is bounded only by `nelems * elem_size \u003c= U32_MAX` the write can run hundreds of megabytes past the buffer, guaranteeing a stack-protector panic or guard-page fault. Any local caller with the required token can trigger this repeatedly for immediate, reliable denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"64e8ee814819f21beeeda00d4119221443d77992\", \"lessThan\": \"6f957d972feee9b385ea3ae6530310a84e55ba71\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"64e8ee814819f21beeeda00d4119221443d77992\", \"lessThan\": \"797d73ee232dd1833dec4824bc53a22032e97c1c\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71\"}, {\"url\": \"https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Check the remaining info_cnt before repeating btf fields\\n\\nWhen trying to repeat the btf fields for array of nested struct, it\\ndoesn\u0027t check the remaining info_cnt. The following splat will be\\nreported when the value of ret * nelems is greater than BTF_FIELDS_MAX:\\n\\n  ------------[ cut here ]------------\\n  UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49\\n  index 11 is out of range for type \u0027btf_field_info [11]\u0027\\n  CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1\\n  Tainted: [O]=OOT_MODULE\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x57/0x70\\n   dump_stack+0x10/0x20\\n   ubsan_epilogue+0x9/0x40\\n   __ubsan_handle_out_of_bounds+0x6f/0x80\\n   ? kallsyms_lookup_name+0x48/0xb0\\n   btf_parse_fields+0x992/0xce0\\n   map_create+0x591/0x770\\n   __sys_bpf+0x229/0x2410\\n   __x64_sys_bpf+0x1f/0x30\\n   x64_sys_call+0x199/0x9f0\\n   do_syscall_64+0x3b/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n  RIP: 0033:0x7fea56f2cc5d\\n  ......\\n   \u003c/TASK\u003e\\n  ---[ end trace ]---\\n\\nFix it by checking the remaining info_cnt in btf_repeat_fields() before\\nrepeating the btf fields.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:42:10.527Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50161\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:42:10.527Z\", \"dateReserved\": \"2024-10-21T19:36:19.961Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-07T09:31:38.118Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.