cve/2024/CVE-2024-49850.md

### [CVE-2024-49850](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49850)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=74753e1462e77349525daf9eb60ea21ed92d3a97%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relosIn case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCALreferencing a non-existing BTF type, function bpf_core_calc_relo_insnwould cause a null pointer deference.Fix this by adding a proper check upper in call stack, as malformedrelocation records could be passed from user space.Simplest reproducer is a program:    r0 = 0    exitWith a single relocation record:    .insn_off = 0,          /* patch first instruction */    .type_id = 100500,      /* this type id does not exist */    .access_str_off = 6,    /* offset of string "0" */    .kind = BPF_CORE_TYPE_ID_LOCAL,See the link for original reproducer or next commit for a test case.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds