CVE-2024-35905
Estado: ModificadaAlta (7.8)—
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Protección contra desbordamiento int para el tamaño de acceso a la pila. Este parche reintroduce la protección contra que el tamaño de acceso a la memoria de la pila sea negativo; el tamaño de acceso puede parecer negativo como resultado de desbordar su representación int firmada. En realidad, esto no debería suceder, ya que existen otras protecciones en el camino, pero debemos protegernos contra ello de todos modos.
Leer descripción completaMostrar menos
A una ruta de código le faltaban dichas protecciones (corregidas en el parche anterior de la serie), lo que provocaba accesos a matrices fuera de los límites en check_stack_range_initialized(). Este parche hace que falle la verificación de un programa con un tamaño de acceso tan absurdo. Esta verificación solía existir de una manera más indirecta, pero se eliminó inadvertidamente en a833a17aeac7.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.22%
- Percentil entre todas las CVEs puntuadas: 12
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-129, CWE-190
Referencias
- https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103
- https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69
- https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69
- https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1
- https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d
- https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8
- https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103
- https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69
- https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69
- https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1
- https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d
- https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-35905",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-35905",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-05-21T15:34:20.280116Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "afea95d319ccb4ad2060dece9ac5e2e364dec543",
"lessThan": "9970e059af471478455f9534e8c3db82f8c5496d",
"versionType": "git"
},
{
"status": "affected",
"version": "02962684258eb53f414a8a59854767be526e6abb",
"lessThan": "37dc1718dc0c4392dbfcb9adec22a776e745dd69",
"versionType": "git"
},
{
"status": "affected",
"version": "b1d4d54d32ce6342f5faffe71bae736540ce7cb5",
"lessThan": "98cdac206b112bec63852e94802791e316acc2c1",
"versionType": "git"
},
{
"status": "affected",
"version": "08b91babccbb168353f8d43fea0ed28a4cad568c",
"lessThan": "3f0784b2f1eb9147973d8c43ba085c5fdf44ff69",
"versionType": "git"
},
{
"status": "affected",
"version": "a833a17aeac73b33f79433d7cee68d5cafd71e4f",
"lessThan": "203a68151e8eeb331d4a64ab78303f3a15faf103",
"versionType": "git"
},
{
"status": "affected",
"version": "a833a17aeac73b33f79433d7cee68d5cafd71e4f",
"lessThan": "ecc6a2101840177e57c925c102d2d29f260d37c8",
"versionType": "git"
},
{
"status": "affected",
"version": "1858b8a331937f3976d8482cd5f6e1f945294ad3",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.209",
"lessThan": "5.10.215",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.148",
"lessThan": "5.15.154",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.75",
"lessThan": "6.1.85",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.14",
"lessThan": "6.6.26",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.7.2",
"lessThan": "6.8",
"versionType": "semver"
}
],
"programFiles": [
"kernel/bpf/verifier.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.215",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.154",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.85",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.26",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.5",
"versionType": "semver",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/bpf/verifier.c"
],
"defaultStatus": "affected"
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-05-19T09:15:11.260",
"references": [
{
"url": "https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-129"
},
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Protect against int overflow for stack access size\n\nThis patch re-introduces protection against the size of access to stack\nmemory being negative; the access size can appear negative as a result\nof overflowing its signed int representation. This should not actually\nhappen, as there are other protections along the way, but we should\nprotect against it anyway. One code path was missing such protections\n(fixed in the previous patch in the series), causing out-of-bounds array\naccesses in check_stack_range_initialized(). This patch causes the\nverification of a program with such a non-sensical access size to fail.\n\nThis check used to exist in a more indirect way, but was inadvertendly\nremoved in a833a17aeac7."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Protección contra desbordamiento int para el tamaño de acceso a la pila. Este parche reintroduce la protección contra que el tamaño de acceso a la memoria de la pila sea negativo; el tamaño de acceso puede parecer negativo como resultado de desbordar su representación int firmada. En realidad, esto no debería suceder, ya que existen otras protecciones en el camino, pero debemos protegernos contra ello de todos modos. A una ruta de código le faltaban dichas protecciones (corregidas en el parche anterior de la serie), lo que provocaba accesos a matrices fuera de los límites en check_stack_range_initialized(). Este parche hace que falle la verificación de un programa con un tamaño de acceso tan absurdo. Esta verificación solía existir de una manera más indirecta, pero se eliminó inadvertidamente en a833a17aeac7."
}
],
"lastModified": "2026-08-04T11:18:09.703",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4866F695-8BAF-42F6-B82E-A11335A27FE5",
"versionEndExcluding": "5.10.215",
"versionStartIncluding": "5.10.209"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A795D3CA-0642-464E-9C92-3E3949C9EFCC",
"versionEndExcluding": "5.15.154",
"versionStartIncluding": "5.15.148"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EFF144D-5904-4571-8285-B5A2010A6097",
"versionEndExcluding": "6.1.85",
"versionStartIncluding": "6.1.75"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "674DF41C-1DB9-4C5E-B7E4-9704A4427E90",
"versionEndExcluding": "6.6.26",
"versionStartIncluding": "6.6.14"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "069B012D-A37C-48F0-B2B4-E6E8EE965640",
"versionEndExcluding": "6.8.5",
"versionStartIncluding": "6.7.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}