CVE-2024-38564

Advisory lineage Upstream: 0 Downstream: 27
Analyzed
Published: 19 Jun 2024, 13:35
Last modified:11 May 2026, 20:19

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
<0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2024, 13:35
Published
Vulnerability first disclosed
11 May 2026, 20:19
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.01%• Percentile: 1%

Affected Systems

  • linux•linux

    ≥ 4a1e7c0c63e02daad751842b7880f9bbcdfb6e89, < 6675c541f540a29487a802d3135280b69b9f568d | ≥ 4a1e7c0c63e02daad751842b7880f9bbcdfb6e89, < 67929e973f5a347f05fef064fea4ae79e7cdb5fd | ≥ 4a1e7c0c63e02daad751842b7880f9bbcdfb6e89, < b34bbc76651065a5eafad8ddff1eb8d1f8473172 | ≥ 4a1e7c0c63e02daad751842b7880f9bbcdfb6e89, < 543576ec15b17c0c93301ac8297333c7b6e84ac7 | 5.10

  • linux•linux_kernel

    ≥ 5.10, < 6.6.33 | ≥ 6.7, < 6.8.12 | ≥ 6.9, < 6.9.3

References (4)