CVE-2024-50262

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds write in trie_get_next_key()

trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < e8494ac079814a53fbc2258d2743e720907488ed; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < 91afbc0eb3c90258ae378ae3c6ead3d2371e926d; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < 590976f921723d53ac199c01d5b7b73a94875e68; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < 86c8ebe02d8806dd8878d0063e8e185622ab6ea6; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < a035df0b98df424559fd383e8e1a268f422ea2ba; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < 90a6e0e1e151ef7a9282e78f54c3091de2dcc99c; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980; >= b471f2f1de8b816f1e799b80aa92588f3566e4bd, < 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21
LinuxLinux4.16
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensRUGGEDCOM RST2428P< V3.2
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family< V3.2
SiemensSCALANCE XCM-/XRM-/XCH-/XRH-300 family< V3.2

References

Timeline

Published
Nov 9, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-502635.5In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reasonCVE-2024-502647.8In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->CVE-2024-502655.5In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_reCVE-2024-502665.5In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs A receCVE-2024-502677.8In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_CVE-2024-502687.1In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_CVE-2024-502697.8In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbcCVE-2024-502705.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feCVE-2024-502715.5In the Linux kernel, the following vulnerability has been resolved: signal: restore the override_rlimit logic Prior to commit d64696905554CVE-2024-502725.5In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemap_read() If the caller supplies CVE-2024-502735.5In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list ACVE-2024-502747.8In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpf_get_link_ksettings When the device co
CVE-2024-50262: High severity, CVSS 7.8 | Vulnix