CVE-2024-45020

A flaw was found in the Linux kernel. A local attacker with specific privileges could trigger an invalid memory access within the BPF (Berkeley Packet Filter) verifier's stacksafe() function. This out-of-bounds access could lead to a kernel crash, resulting in a Denial of Service (DoS) for the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict the ability to load unprivileged BPF programs. This can be achieved by setting the kernel.unprivileged_bpf_disabled sysctl parameter to 1. To apply this change immediately: echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled For persistent configuration across reboots, add kernel.unprivileged_bpf_disabled = 1 to a file like /etc/sysctl.d/99-disable-unprivileged-bpf.conf and apply with sysctl -p. Disabling unprivileged BPF may impact applications that depend on this feature. A system reboot may be required for the change to take full effect.