Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package bpftool  (opens in a new tab)

Threat Intelligence

EPSS
0.22% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-BPFTOOL-7738566
  • published21 Aug 2024
  • disclosed17 Aug 2024
Report a new vulnerability Found a mistake?

Introduced: 17 Aug 2024

CVE-2024-42312  (opens in a new tab)
CWE-20  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bpftool package and not the bpftool package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

sysctl: always initialize i_uid/i_gid

Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them.

Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.