Threats tagged 'ghsa-63vm-hcp4-j9j3'

CVE-2024-43837 is a vulnerability in the Linux kernel's BPF subsystem where a null pointer dereference occurs in the resolve_prog_type() function for BPF_PROG_TYPE_EXT programs. This happens when an EXT program is loaded without specifying the attach_prog_fd attribute, causing a null pointer dereference and a kernel crash (Oops). The issue was introduced by a recent commit that changed how program types are resolved. The fix involves returning the program's own type if the destination program pointer is null, preventing the null dereference.