CVE-2024-35905 – This CVE addresses an integer overflow vulnerab... (How to Fix)

Q: What is the severity of CVE-2024-35905?

CVE-2024-35905 has a CVSS score of 7.8 (HIGH). This CVE addresses an integer overflow vulnerability in the Linux kernel's BPF verifier that could allow out-of-bounds memory access. Attackers could potentially exploit this to cause kernel crashes or achieve local privilege escalation. Systems running vulnerable Linux kernel versions with BPF enabled are affected.

📋 TL;DR

This CVE addresses an integer overflow vulnerability in the Linux kernel's BPF verifier that could allow out-of-bounds memory access. Attackers could potentially exploit this to cause kernel crashes or achieve local privilege escalation. Systems running vulnerable Linux kernel versions with BPF enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not explicitly stated, but affects kernels where commit a833a17aeac7 removed protections and before fixes were applied.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires BPF subsystem to be enabled and accessible. Most modern Linux distributions have BPF enabled by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to full system compromise, kernel memory corruption, or denial of service through kernel panic.

🟠

Likely Case

Kernel crash or denial of service, potentially leading to system instability.

🟢

If Mitigated

Minimal impact if BPF is disabled or proper kernel hardening is implemented.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring local access to exploit.

🏢 Internal Only: MEDIUM - Could be exploited by malicious users or compromised accounts with local access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires crafting malicious BPF programs and local access. The vulnerability is in the verifier, so exploitation would bypass security checks.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 203a68151e8e, 37dc1718dc0c, 3f0784b2f1eb, 98cdac206b11, 9970e059af47

Vendor Advisory: https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable BPF subsystem

linux

Prevents exploitation by disabling the vulnerable component

echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled
sysctl -w kernel.unprivileged_bpf_disabled=1

Restrict BPF usage

linux

Limit BPF program loading to privileged users only

sysctl -w kernel.unprivileged_bpf_disabled=2

🧯 If You Can't Patch

Implement strict access controls to limit local user privileges
Monitor for unusual BPF program loading or kernel module activity

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution security advisories. Vulnerable if running kernel without the listed fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: 203a68151e8e, 37dc1718dc0c, 3f0784b2f1eb, 98cdac206b11, or 9970e059af47

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
BPF verifier failure logs
System crash/panic logs

Network Indicators:

Not applicable - local vulnerability

SIEM Query:

source="kernel" AND ("BPF" OR "verifier" OR "stack access") AND ("overflow" OR "out of bounds" OR "panic")

📊 Metadata

CVE ID: CVE-2024-35905

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-129

Published: May 19, 2024

Last Updated: December 30, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35905, you might also want to check these: