CVE-2024-47794
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tailcall infinite loop caused by freplace There is a potential infinite loop issue that can occur when using a combination of tail calls and freplace. In an upcoming selftest, the attach target for entry_freplace of tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in entry_freplace leads to entry_tc. This results in an infinite loop: entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc. The problem arises because the tail_call_cnt in entry_freplace resets to zero each time entry_freplace is executed, causing the tail call mechanism to never terminate, eventually leading to a kernel panic. To fix this issue, the solution is twofold: 1. Prevent updating a program extended by an freplace program to a prog_array map. 2. Prevent extending a program that is already part of a prog_array map with an freplace program. This ensures that: * If a program or its subprogram has been extended by an freplace program, it can no longer be updated to a prog_array map. * If a program has been added to a prog_array map, neither it nor its subprograms can be extended by an freplace program. Moreover, an extension program should not be tailcalled. As such, return -EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a prog_array map. Additionally, fix a minor code style issue by replacing eight spaces with a tab for proper formatting.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-01-11 13:15:22.390000
Last modified
2026-10-30 13:17:37.863000
View original CVE JSON
{
"id": "CVE-2024-47794",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-01-11T13:15:22.390",
"lastModified": "2026-10-30T13:17:37.863",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tailcall infinite loop caused by freplace\n\nThere is a potential infinite loop issue that can occur when using a\ncombination of tail calls and freplace.\n\nIn an upcoming selftest, the attach target for entry_freplace of\ntailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in\nentry_freplace leads to entry_tc. This results in an infinite loop:\n\nentry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.\n\nThe problem arises because the tail_call_cnt in entry_freplace resets to\nzero each time entry_freplace is executed, causing the tail call mechanism\nto never terminate, eventually leading to a kernel panic.\n\nTo fix this issue, the solution is twofold:\n\n1. Prevent updating a program extended by an freplace program to a\n prog_array map.\n2. Prevent extending a program that is already part of a prog_array map\n with an freplace program.\n\nThis ensures that:\n\n* If a program or its subprogram has been extended by an freplace program,\n it can no longer be updated to a prog_array map.\n* If a program has been added to a prog_array map, neither it nor its\n subprograms can be extended by an freplace program.\n\nMoreover, an extension program should not be tailcalled. As such, return\n-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a\nprog_array map.\n\nAdditionally, fix a minor code style issue by replacing eight spaces with a\ntab for proper formatting."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Evitar bucle infinito de tailcall causado por freplace Existe un posible problema de bucle infinito que puede ocurrir al usar una combinación de llamadas de cola y freplace. En una próxima autoprueba, el objetivo de conexión para entry_freplace de tailcall_freplace.c es subprog_tc de tc_bpf2bpf.c, mientras que la llamada de cola en entry_freplace conduce a entry_tc. Esto da como resultado un bucle infinito: entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc. El problema surge porque tail_call_cnt en entry_freplace se restablece a cero cada vez que se ejecuta entry_freplace, lo que hace que el mecanismo de llamada de cola nunca finalice, lo que finalmente conduce a un pánico del kernel. Para solucionar este problema, la solución es doble: 1. Evitar actualizar un programa extendido por un programa freplace a un mapa prog_array. 2. Evite extender un programa que ya es parte de un mapa prog_array con un programa freplace. Esto garantiza que: * Si un programa o su subprograma ha sido extendido por un programa freplace, ya no puede actualizarse a un mapa prog_array. * Si un programa ha sido agregado a un mapa prog_array, ni él ni sus subprogramas pueden ser extendidos por un programa freplace. Además, un programa de extensión no debe ser llamado al final. Como tal, devuelva -EINVAL si el programa tiene un tipo de BPF_PROG_TYPE_EXT al agregarlo a un mapa prog_array. Además, solucione un problema menor de estilo de código reemplazando ocho espacios con una tabulación para un formato adecuado."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/arraymap.c",
"kernel/bpf/core.c",
"kernel/bpf/syscall.c",
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "be8704ff07d2374bcc5c675526f95e70c6459683",
"lessThan": "272f92998cbec9e12fea8ef28f48d6b1bc625a34",
"versionType": "git",
"status": "affected"
},
{
"version": "be8704ff07d2374bcc5c675526f95e70c6459683",
"lessThan": "f8ba0d22afa613b280fc40fcf6ae99f73c7b36e6",
"versionType": "git",
"status": "affected"
},
{
"version": "be8704ff07d2374bcc5c675526f95e70c6459683",
"lessThan": "987aa730bad3e1ef66d9f30182294daa78f6387d",
"versionType": "git",
"status": "affected"
},
{
"version": "be8704ff07d2374bcc5c675526f95e70c6459683",
"lessThan": "d6083f040d5d8f8d748462c77e90547097df936e",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/arraymap.c",
"kernel/bpf/core.c",
"kernel/bpf/syscall.c",
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.5",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.13",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:40:26.998555Z",
"id": "CVE-2024-47794",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-835"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6",
"versionEndExcluding": "6.12.5",
"matchCriteriaId": "83E30040-8849-4588-B81C-AE479356574C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/272f92998cbec9e12fea8ef28f48d6b1bc625a34",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/987aa730bad3e1ef66d9f30182294daa78f6387d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d6083f040d5d8f8d748462c77e90547097df936e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f8ba0d22afa613b280fc40fcf6ae99f73c7b36e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}