In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/data_end/data_meta… (CVE-2024-47702)
A vulnerability in the Linux kernel's BPF verifier related to sign-extension of packet data fields has been resolved. The issue involved improper verification of sign-extension when accessing __sk_buff packet data, data_end, and data_meta fields, which could cause kernel crashes. The fix adds additional checks to fail verification if sign-extension is used improperly in these contexts.
AI Analysis
Technical Summary
CVE-2024-47702 addresses a Linux kernel vulnerability in the BPF verifier where sign-extension of 32-bit loads for packet data (__sk_buff->data, data_end, data_meta) was not properly handled. This could lead to invalid kernel addresses and runtime failures or crashes. The patch adds stricter verification in the is_valid_access() callback to reject sign-extended accesses to these packet pointers, preventing invalid memory references during BPF program verification.
Potential Impact
The vulnerability can cause kernel crashes due to invalid memory accesses when BPF programs improperly use sign-extension on packet data pointers. The CVSS score of 5.5 (medium severity) reflects a local attacker with low privileges potentially causing denial of service via kernel crash. There is no indication of confidentiality or integrity impact.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add verification checks that reject sign-extended accesses to packet data fields in BPF programs. Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/data_end/data_meta… (CVE-2024-47702)
Description
A vulnerability in the Linux kernel's BPF verifier related to sign-extension of packet data fields has been resolved. The issue involved improper verification of sign-extension when accessing __sk_buff packet data, data_end, and data_meta fields, which could cause kernel crashes. The fix adds additional checks to fail verification if sign-extension is used improperly in these contexts.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-47702 addresses a Linux kernel vulnerability in the BPF verifier where sign-extension of 32-bit loads for packet data (__sk_buff->data, data_end, data_meta) was not properly handled. This could lead to invalid kernel addresses and runtime failures or crashes. The patch adds stricter verification in the is_valid_access() callback to reject sign-extended accesses to these packet pointers, preventing invalid memory references during BPF program verification.
Potential Impact
The vulnerability can cause kernel crashes due to invalid memory accesses when BPF programs improperly use sign-extension on packet data pointers. The CVSS score of 5.5 (medium severity) reflects a local attacker with low privileges potentially causing denial of service via kernel crash. There is no indication of confidentiality or integrity impact.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add verification checks that reject sign-extended accesses to packet data fields in BPF programs. Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-37rv-6wmp-jjqr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-47702"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac13969a43b0b3b89d5fbbe
Added to database: 10/03/2026, 17:20:41 UTC
Last enriched: 10/03/2026, 17:24:44 UTC
Last updated: 10/04/2026, 02:45:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.