Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2024-47728: Linux kernel BPF helpers could leak memory
CVE-2024-47728 · published 2 years ago
Summary
The Linux kernel versions used in Canonical's GKE, GKE‑OP, IBM, low‑latency, and NVIDIA builds had a flaw where some BPF helper functions could return uninitialized data, potentially exposing internal memory contents. The fix ensures that on error these values are cleared, preventing accidental data leakage. Apply the latest kernel updates for your Linux distribution to incorporate the patch.
What to do
- Update canonical linux-gke to version 6.8.0-1019.23.
- Update canonical linux-gkeop to version 6.8.0-1006.8.
- Update canonical linux-ibm to version 6.8.0-1022.22.
- Update canonical linux-lowlatency to version 6.8.0-54.56.1.
- Update canonical linux-nvidia to version 6.8.0-1022.25.
- Update canonical linux-nvidia-6.11 to version 6.11.0-1007.7.
- Update canonical linux-nvidia-lowlatency to version 6.8.0-1022.25.2.
- Update canonical linux-oem-6.11 to version 6.11.0-1015.15.
- Update canonical linux-oem-6.8 to version 6.8.0-1024.24.
- Update canonical linux-oracle to version 6.8.0-1020.21.
- Update canonical linux-raspi to version 6.8.0-1019.23.
- Update canonical linux-riscv to version 6.8.0-53.55.1.
- Update canonical linux-xilinx to version 6.8.0-1017.18.
- Update canonical linux-fips to version 6.8.0-78.78+fips1.
- Update canonical linux-raspi-realtime to version 6.8.0-2018.19.
- Update canonical linux-realtime to version 6.8.1-1016.17.
- Update canonical linux-aws-6.8 to version 6.8.0-1023.25~22.04.1.
- Update canonical linux-azure-6.8 to version 6.8.0-1025.30~22.04.1.
- Update canonical linux-gcp-6.8 to version 6.8.0-1024.26~22.04.1.
- Update canonical linux-hwe-6.8 to version 6.8.0-57.59~22.04.1.
- Update canonical linux-ibm-6.8 to version 6.8.0-1023.23~22.04.1.
- Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-54.56.1~22.04.1.
- Update canonical linux-nvidia-6.8 to version 6.8.0-1022.25~22.04.2.
- Update canonical linux-oracle-6.8 to version 6.8.0-1020.21~22.04.1.
- Update canonical linux-riscv-6.8 to version 6.8.0-53.55.1~22.04.1.
- Update canonical linux-realtime-6.8 to version 6.8.1-1016.17~22.04.1.
- Update canonical linux to version 6.8.0-54.56.
- Update canonical linux-aws to version 6.8.0-1023.25.
- Update canonical linux-azure to version 6.8.0-1025.30.
- Update canonical linux-azure-6.11 to version 6.11.0-1012.12~24.04.1.
- Update canonical linux-azure-nvidia to version 6.8.0-1014.15.
- Update canonical linux-gcp to version 6.8.0-1024.26.
- Update canonical linux-gcp-6.11 to version 6.11.0-1011.11~24.04.1.
- Update debian rootio-linux to version 5.10.247-1.root.io.42.
- Update canonical rootio-linux to version 5.15.0-186.196.root.io.103.
- Update debian linux to version 6.1.115-1.
- Update debian linux to version 6.11.2-1.
- Update linux to version 5.15.0-198.208.aikido.116.
- Update rootio-linux to version 5.15.0-198.208.aikido.116.
- Update linux kernel to version 6.11.2.
- Update linux to version 5.15.0-202.212.aikido.118.
- Update rootio-linux to version 5.15.0-202.212.aikido.118.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:24.04:LTS | canonical | linux-gke |
< 6.8.0-1019.23 Fix: upgrade to 6.8.0-1019.23
|
| Ubuntu:24.04:LTS | canonical | linux-gkeop |
< 6.8.0-1006.8 Fix: upgrade to 6.8.0-1006.8
|
| Ubuntu:24.04:LTS | canonical | linux-ibm |
< 6.8.0-1022.22 Fix: upgrade to 6.8.0-1022.22
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency |
< 6.8.0-54.56.1 Fix: upgrade to 6.8.0-54.56.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia |
< 6.8.0-1022.25 Fix: upgrade to 6.8.0-1022.25
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 |
< 6.11.0-1007.7 Fix: upgrade to 6.11.0-1007.7
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency |
< 6.8.0-1022.25.2 Fix: upgrade to 6.8.0-1022.25.2
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 |
< 6.11.0-1015.15 Fix: upgrade to 6.11.0-1015.15
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 |
< 6.8.0-1024.24 Fix: upgrade to 6.8.0-1024.24
|
| Ubuntu:24.04:LTS | canonical | linux-oracle |
< 6.8.0-1020.21 Fix: upgrade to 6.8.0-1020.21
|
| Ubuntu:24.04:LTS | canonical | linux-raspi |
< 6.8.0-1019.23 Fix: upgrade to 6.8.0-1019.23
|
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv |
< 6.8.0-53.55.1 Fix: upgrade to 6.8.0-53.55.1
|
| Ubuntu:24.04:LTS | canonical | linux-xilinx |
< 6.8.0-1017.18 Fix: upgrade to 6.8.0-1017.18
|
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-fips |
< 6.8.0-78.78+fips1 Fix: upgrade to 6.8.0-78.78+fips1
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-raspi-realtime |
< 6.8.0-2018.19 Fix: upgrade to 6.8.0-2018.19
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime |
< 6.8.1-1016.17 Fix: upgrade to 6.8.1-1016.17
|
| – | linux | linux_kernel |
>= 5.2, < 6.1.113 >= 6.2, < 6.6.54 >= 6.7, < 6.10.13 >= 6.11, < 6.11.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-raspi-5.4 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
Showing 50 of 186. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-hwe-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-intel-iotg-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-iot | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-nvidia-tegra-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-riscv-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 |
< 6.8.0-1023.25~22.04.1 Fix: upgrade to 6.8.0-1023.25~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 |
< 6.8.0-1025.30~22.04.1 Fix: upgrade to 6.8.0-1025.30~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 |
< 6.8.0-1024.26~22.04.1 Fix: upgrade to 6.8.0-1024.26~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 |
< 6.8.0-57.59~22.04.1 Fix: upgrade to 6.8.0-57.59~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 |
< 6.8.0-1023.23~22.04.1 Fix: upgrade to 6.8.0-1023.23~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg | All versions |
| Ubuntu:22.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 |
< 6.8.0-54.56.1~22.04.1 Fix: upgrade to 6.8.0-54.56.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 |
< 6.8.0-1022.25~22.04.2 Fix: upgrade to 6.8.0-1022.25~22.04.2
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 |
< 6.8.0-1020.21~22.04.1 Fix: upgrade to 6.8.0-1020.21~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 |
< 6.8.0-53.55.1~22.04.1 Fix: upgrade to 6.8.0-53.55.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:Nvidia-BlueField:22.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 |
< 6.8.1-1016.17~22.04.1 Fix: upgrade to 6.8.1-1016.17~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux |
< 6.8.0-54.56 Fix: upgrade to 6.8.0-54.56
|
| Ubuntu:24.04:LTS | canonical | linux-aws |
< 6.8.0-1023.25 Fix: upgrade to 6.8.0-1023.25
|
| Ubuntu:24.04:LTS | canonical | linux-azure |
< 6.8.0-1025.30 Fix: upgrade to 6.8.0-1025.30
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 |
< 6.11.0-1012.12~24.04.1 Fix: upgrade to 6.11.0-1012.12~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia |
< 6.8.0-1014.15 Fix: upgrade to 6.8.0-1014.15
|
| Ubuntu:24.04:LTS | canonical | linux-gcp |
< 6.8.0-1024.26 Fix: upgrade to 6.8.0-1024.26
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 |
< 6.11.0-1011.11~24.04.1 Fix: upgrade to 6.11.0-1011.11~24.04.1
|
| Root:Debian:11 | debian | rootio-linux |
< 5.10.247-1.root.io.42 Fix: upgrade to 5.10.247-1.root.io.42
|
| Root:Ubuntu:22.04 | canonical | rootio-linux |
< 5.15.0-186.196.root.io.103 Fix: upgrade to 5.15.0-186.196.root.io.103
|
| Debian:12 | debian | linux |
< 6.1.115-1 Fix: upgrade to 6.1.115-1
|
| Debian:13 | debian | linux |
< 6.11.2-1 Fix: upgrade to 6.11.2-1
|
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Root:Ubuntu:22.04 | – | linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Root:Ubuntu:22.04 | – | rootio-linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Linux | linux | kernel |
>= 6.11.0, < 6.11.2 Fix: upgrade to 6.11.2
|
Original advisory text
CVE-2024-47728 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error For all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input arguments, zero the value for the case of an error as otherwise it could leak memory. For tracing, it is not needed given CAP_PERFMON can already read all kernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped in here. Also, the MTU helpers mtu_len pointer value is being written but also read. Technically, the MEM_UNINIT should not be there in order to always force init. Removing MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now implies two things actually: i) write into memory, ii) memory does not have to be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory, ii) memory must be initialized. This means that for bpf_*_check_mtu() we're readding the issue we're trying to fix, that is, it would then be able to write back into things like .rodata BPF maps. Follow-up work will rework the MEM_UNINIT semantics such that the intent can be better expressed. For now just clear the *mtu_len on error path which can be lifted later again.
References
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html URL
- https://security-tracker.debian.org/tracker/CVE-2024-47728 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7303-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47728... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47728 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://git.kernel.org/stable/c/8397bf78988f3ae9dbebb0200189a62a57264980 Third Party Advisory
- https://git.kernel.org/stable/c/a634fa8e480ac2423f86311a602f6295df2c8ed0 Third Party Advisory
- https://git.kernel.org/stable/c/599d15b6d03356a97bff7a76155c5604c42a2962 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7311-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7303-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7384-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7385-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7386-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7384-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7403-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7468-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-47728 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-47728 Third Party Advisory
- https://git.kernel.org/linus/4b3786a6c5397dc220b1483d8e2f4867743e966f Third Party Advisory
- https://git.kernel.org/stable/c/594a9f5a8d2de2573a856e506f77ba7dd2cefc6a Third Party Advisory
- https://git.kernel.org/stable/c/4b3786a6c5397dc220b1483d8e2f4867743e966f Third Party Advisory
- https://ubuntu.com/security/notices/USN-7276-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7277-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7301-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7304-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7303-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7310-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Type
CWE-459Incomplete Cleanup
Timeline
Published21 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2024-47728 · NVD
UBUNTU-CVE-2024-47728 · OSV
DEBIAN-CVE-2024-47728 · OSV
CVE-2024-47728 · OSV
Track software like this
Free during beta