Threats tagged 'ghsa-8ghr-4wgh-3jq8'

CVE-2024-42063 is a medium severity vulnerability in the Linux kernel's BPF subsystem where uninitialized stack memory can be accessed in interpreter mode during map lookup and delete operations. The issue arises from uninitialized 'void *key' memory passed to the dev_map_lookup_elem helper, which can lead to undefined behavior. The vulnerability was reported by syzbot and addressed by marking the BPF program stack memory as initialized using kmsan_unpoison_memory().