{"id":"CVE-2024-45020","summary":"bpf: Fix a kernel verifier crash in stacksafe()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a kernel verifier crash in stacksafe()\n\nDaniel Hodges reported a kernel verifier crash when playing with sched-ext.\nFurther investigation shows that the crash is due to invalid memory access\nin stacksafe(). More specifically, it is the following code:\n\n    if (exact != NOT_EXACT &&\n        old-\u003estack[spi].slot_type[i % BPF_REG_SIZE] !=\n        cur-\u003estack[spi].slot_type[i % BPF_REG_SIZE])\n            return false;\n\nThe 'i' iterates old-\u003eallocated_stack.\nIf cur-\u003eallocated_stack \u003c old-\u003eallocated_stack the out-of-bound\naccess will happen.\n\nTo fix the issue add 'i \u003e= cur-\u003eallocated_stack' check such that if\nthe condition is true, stacksafe() should fail. Otherwise,\ncur-\u003estack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.","modified":"2026-04-02T12:18:39.586563Z","published":"2024-09-11T15:13:54.591Z","related":["ALSA-2024:11486","SUSE-SU-2024:3551-1","SUSE-SU-2024:3553-1","SUSE-SU-2024:3561-1","SUSE-SU-2024:3564-1","SUSE-SU-2024:3569-1","SUSE-SU-2024:3587-1","SUSE-SU-2024:3592-1","SUSE-SU-2025:20073-1","SUSE-SU-2025:20077-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45020.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7cad3174cc79519bf5f6c4441780264416822c08"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bed2eb964c70b780fb55925892a74f26cb590b25"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45020.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45020"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ab470fefce2837e66b771c60858118d50bb5bb10"},{"fixed":"7cad3174cc79519bf5f6c4441780264416822c08"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2793a8b015f7f1caadb9bce9c63dc659f7522676"},{"fixed":"6e3987ac310c74bb4dd6a2fa8e46702fe505fb2b"},{"fixed":"bed2eb964c70b780fb55925892a74f26cb590b25"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45020.json"}}],"schema_version":"1.7.5"}