Threats tagged 'ghsa-qvf9-958h-6h8p'

CVE-2024-49850 is a medium severity vulnerability in the Linux kernel's BPF subsystem. It involves improper handling of malformed BPF_CORE_TYPE_ID_LOCAL relocation records referencing non-existent BTF types, leading to a null pointer dereference. This flaw can cause a denial of service (kernel crash) when processing such malformed records. The issue arises because the function bpf_core_calc_relo_insn lacks an adequate check for invalid type IDs, allowing user space to trigger the fault. The vulnerability has been fixed by adding proper validation higher in the call stack to prevent malformed relocations from causing crashes.