NVD Vulnerability Detail

CVE-2024-50262

Summary	In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8.
Publication Date	Nov. 9, 2024, 8:15 p.m.
Registration Date	Nov. 10, 2024, 5 a.m.
Last Update	Nov. 14, 2024, 6:10 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/stable/c/e8494ac079814a53fbc2258d2743e720907488ed	Patch
2	https://git.kernel.org/stable/c/91afbc0eb3c90258ae378ae3c6ead3d2371e926d	Patch
3	https://git.kernel.org/stable/c/590976f921723d53ac199c01d5b7b73a94875e68	Patch
4	https://git.kernel.org/stable/c/86c8ebe02d8806dd8878d0063e8e185622ab6ea6	Patch
5	https://git.kernel.org/stable/c/a035df0b98df424559fd383e8e1a268f422ea2ba	Patch
6	https://git.kernel.org/stable/c/90a6e0e1e151ef7a9282e78f54c3091de2dcc99c	Patch
7	https://git.kernel.org/stable/c/c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980	Patch
8	https://git.kernel.org/stable/c/13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

Linux の Linux Kernel における境界外書き込みに関する脆弱性

Title	Linux の Linux Kernel における境界外書き込みに関する脆弱性
Summary	Linux の Linux Kernel には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 29, 2024, midnight
Registration Date	Nov. 14, 2024, 5:01 p.m.
Last Update	Aug. 21, 2025, 1:57 p.m.

Affected System

Linux

Linux Kernel 4.16 以上 4.19.323 未満

Linux Kernel 4.20 以上 5.4.285 未満

Linux Kernel 5.11 以上 5.15.171 未満

Linux Kernel 5.16 以上 6.1.116 未満

Linux Kernel 5.5 以上 5.10.229 未満

Linux Kernel 6.12

Linux Kernel 6.2 以上 6.6.60 未満

Linux Kernel 6.7 以上 6.11.7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-50262	https://www.cve.org/CVERecord?id=CVE-2024-50262
National Vulnerability Database (NVD)
2	CVE-2024-50262	https://nvd.nist.gov/vuln/detail/CVE-2024-50262

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
Kernel.org git repositories
1	bpf: Fix out-of-bounds write in trie_get_next_key() (13400ac)	https://git.kernel.org/stable/c/13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21
2	bpf: Fix out-of-bounds write in trie_get_next_key() (590976f)	https://git.kernel.org/stable/c/590976f921723d53ac199c01d5b7b73a94875e68
3	bpf: Fix out-of-bounds write in trie_get_next_key() (86c8ebe)	https://git.kernel.org/stable/c/86c8ebe02d8806dd8878d0063e8e185622ab6ea6
4	bpf: Fix out-of-bounds write in trie_get_next_key() (90a6e0e)	https://git.kernel.org/stable/c/90a6e0e1e151ef7a9282e78f54c3091de2dcc99c
5	bpf: Fix out-of-bounds write in trie_get_next_key() (91afbc0)	https://git.kernel.org/stable/c/91afbc0eb3c90258ae378ae3c6ead3d2371e926d
6	bpf: Fix out-of-bounds write in trie_get_next_key() (a035df0)	https://git.kernel.org/stable/c/a035df0b98df424559fd383e8e1a268f422ea2ba
7	bpf: Fix out-of-bounds write in trie_get_next_key() (c4b4f9a)	https://git.kernel.org/stable/c/c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980
8	bpf: Fix out-of-bounds write in trie_get_next_key() (e8494ac)	https://git.kernel.org/stable/c/e8494ac079814a53fbc2258d2743e720907488ed
Linux Kernel
9	Linux Kernel Archives	https://www.kernel.org

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-25-226-07	https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07
JVN
2	JVNVU#92169998	https://jvn.jp/vu/JVNVU92169998/index.html

Change Log

No	Changed Details	Date of change
1	[2024年11月14日] 掲載	Nov. 14, 2024, 5:01 p.m.
2	[2025年08月21日] 参考情報：JVN (JVNVU#92169998) を追加参考情報：ICS-CERT ADVISORY (ICSA-25-226-07) を追加	Aug. 21, 2025, 1:56 p.m.