CVE-2024-50203 Details

A heap buffer overflow vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) implementation for ARM64 architecture, specifically when tag-based KASAN (Kernel Address Sanitizer) is enabled. The issue arises in the BPF trampoline mechanism, where the address of a 'bpf_tramp_image' struct is incorrectly handled. During the size calculation phase, the address is taken from the stack, but during code generation, a heap address is used. If the heap address is tagged, this mismatch can lead to a buffer overflow, as the code generation process may inadvertently produce longer instructions, exceeding the intended buffer size. This vulnerability can also occur without tag-based KASAN if a stack address word is all-ones during size calculation, creating a similar overflow risk.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.