{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46764", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.272Z", "datePublished": "2024-09-18T07:12:23.591Z", "dateUpdated": "2026-08-05T11:38:26.724Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:26.724Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: add check for invalid name in btf_name_valid_section()\n\nIf the length of the name string is 1 and the value of name[0] is NULL\nbyte, an OOB vulnerability occurs in btf_name_valid_section() and the\nreturn value is true, so the invalid name passes the check.\n\nTo solve this, you need to check if the first position is NULL byte and\nif the first character is printable." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only path to `btf_name_valid_section()` is the `bpf(BPF_BTF_LOAD)` syscall (`bpf_btf_load()` → `btf_new_fd()` → `btf_parse()` → `btf_datasec_check_meta()`), which requires local access to submit an attacker-crafted BTF blob. No network- or peer-supplied data reaches BTF parsing.\nAC:L - The attacker fully controls the BTF blob and can set a DATASEC `name_off` to exactly `hdr.str_len - 1`, which `btf_check_meta()` accepts and which is guaranteed by `btf_parse_str_sec()` to be the last byte of the allocation, so the `src++` walks off the end every single time. By choosing a page-aligned blob above `KMALLOC_MAX_SIZE` the attacker also forces the `kvmalloc()` vmalloc fallback so the first OOB byte lands on the vmalloc guard page — a 100% reproducible, single-shot trigger with no race and no layout luck.\nPR:L - `bpf_btf_load()` gates on `bpf_token_capable(token, CAP_BPF)`, which under a BPF token (present in every affected version, v6.9–v6.11) degrades to `ns_capable(token->userns, CAP_BPF)`, so a non-root user inside a delegated user namespace — or any unprivileged service account granted ambient CAP_BPF, as CNI/observability agents routinely are — can load arbitrary BTF. This is a low-privilege local account, not real root in the init namespace.\nUI:N - The attacker performs the entire sequence itself with a single `bpf(BPF_BTF_LOAD)` call on a blob it constructs; no other user or process needs to act.\nS:U - The out-of-bounds read occurs in kernel heap/vmalloc memory within the same security authority that hosts the calling process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop reads up to `KSYM_NAME_LEN` (512) bytes of adjacent kernel memory past the end of the `kvmalloc()` allocation — far beyond a strictly bounded few-byte overread — exposing neighbouring slab contents that the attacker can groom, with the boolean load result acting as an oracle on that data.\nI:L - The bug is a validation bypass as well as an overread: removing the `src++` in the fix shows the pre-fix code never checked the first character, so both empty names and names with a leading non-printable/control byte were admitted into kernel-held BTF state and are surfaced in verifier-log output and via `BPF_BTF_GET_FD_BY_ID` to consuming tooling. There is no write primitive, so the integrity effect is limited rather than arbitrary.\nA:H - With a page-aligned BTF blob above `KMALLOC_MAX_SIZE`, `kvmalloc()` falls back to `vmalloc()`, which appends a guard page in `__get_vm_area_node()`, so the very first out-of-bounds byte dereferences unmapped kernel memory and produces an unhandled paging request / oops (a full panic with `panic_on_oops`). Even in the slab case this is a KASAN-reportable slab-out-of-bounds read, and the trigger is cheap and repeatable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/btf.c" ], "versions": [ { "version": "bd70a8fb7ca4fcb078086f4d96b048aaf1aa4786", "lessThan": "c8ffe2d4d37a05ce18c71b87421443c16f8475e5", "status": "affected", "versionType": "git" }, { "version": "bd70a8fb7ca4fcb078086f4d96b048aaf1aa4786", "lessThan": "bb6705c3f93bed2af03d43691743d4c43e3c8e6f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/btf.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c8ffe2d4d37a05ce18c71b87421443c16f8475e5" }, { "url": "https://git.kernel.org/stable/c/bb6705c3f93bed2af03d43691743d4c43e3c8e6f" } ], "title": "bpf: add check for invalid name in btf_name_valid_section()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:43:02.991140Z", "id": "CVE-2024-46764", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:43:16.765Z" } } ] } }