{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50063", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.939Z", "datePublished": "2024-10-21T19:39:51.718Z", "dateUpdated": "2026-08-05T11:41:20.424Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:20.424Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tail call between progs attached to different hooks\n\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\n\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\n\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\n\nThis patch adds restriction for tail call to prevent such bypasses." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the local `bpf()` syscall — loading two programs, populating a `BPF_MAP_TYPE_PROG_ARRAY` via `bpf_map_update_elem()`, and attaching one to a hook. Per kernel scoring convention BPF bugs are Local; no network or adjacent-network path exists.\nAC:L - Triggering is fully deterministic and entirely attacker-constructed: load prog A on hook X and prog B on hook Y, insert B into the prog array, attach A, then invoke hook X (e.g. any `open()` for `file_permission`/`file_alloc_security`, or any fentry-traced function). There is no race, no dependence on uncontrolled memory layout, and BTF/trampoline/fentry support plus `CONFIG_BPF_LSM` are enabled by default in mainstream distro kernels.\nPR:L - The attacker needs `CAP_BPF`+`CAP_PERFMON`, which were deliberately split out of `CAP_SYS_ADMIN` precisely so BPF tracing could be granted to non-administrative principals — observability agents, sidecars, and containers routinely hold them without root, and verifier soundness is the stated boundary they rely on. `bpf_token_capable()` further resolves to `ns_capable(token->userns, ...)`, so with a delegating bpffs mount a user-namespace-confined, non-root principal can load TRACING/LSM programs; this is a constrained delegated privilege, not administrative control over the kernel.\nUI:N - The attacker performs every step in its own processes — load, map update, attach, and trigger. No victim action, mount, or file open by another user is required.\nS:U - Both the flawed component (BPF verifier/prog-array compatibility check) and the impacted component (kernel memory and LSM decisions) are the kernel itself, under one security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The callee reads ctx slots the verifier typed from a different hook's prototype, giving out-of-bounds reads of the caller's trampoline frame (traced return value, saved frame pointer — kernel stack and text disclosure defeating KASLR) and, in the same-arity case, a verifier-trusted `PTR_TO_BTF_ID` of the wrong struct type. Because `PTR_TO_BTF_ID` loads are compiled to fault-safe `BPF_PROBE_MEM`, this is a reliable arbitrary kernel-memory read oracle whose results can be exfiltrated through any BPF map.\nI:H - The forged trusted pointer passes `KF_TRUSTED_ARGS` kfunc checks (`bpf_task_release`, `bpf_sk_release`, `bpf_cgroup_release`), so a refcount field is decremented at an attacker-chosen offset inside an unrelated object — a use-after-free that is the standard route to an arbitrary kernel write and control-flow hijack. Independently, the return-value bypass lets a BPF LSM hook return a value outside its contract, so `security_file_alloc()` yields `ERR_PTR(1)` that `IS_ERR()` misses and the VFS uses as a `struct file *`, and it also lets access-control verdicts be forged.\nA:H - The companion fix 5d99e198be27 documents that a positive `file_alloc_security` return \"makes kernel panic\" because the filesystem dereferences it as a file pointer — this CVE re-opens exactly that path through tail calls, from an ordinary `open()`. The type-confused trusted pointer likewise causes oopses and use-after-free crashes when consumed by kfuncs that do not use probe-read semantics." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf.h", "kernel/bpf/core.c" ], "versions": [ { "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "d9a807fb7cbfad4328824186e2e4bee28f72169b", "status": "affected", "versionType": "git" }, { "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1", "status": "affected", "versionType": "git" }, { "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1", "status": "affected", "versionType": "git" }, { "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "28ead3eaabc16ecc907cfb71876da028080f6356", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf.h", "kernel/bpf/core.c" ], "versions": [ { "version": "5.5", "status": "affected" }, { "version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.135", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.11.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d9a807fb7cbfad4328824186e2e4bee28f72169b" }, { "url": "https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1" }, { "url": "https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1" }, { "url": "https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356" } ], "title": "bpf: Prevent tail call between progs attached to different hooks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50063", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:22:37.407385Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:28:41.892Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:31:40.086Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:38:16.750Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }