CVE-2024-46764·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btf_name_valid_section() If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.10.10
- Published
- 2024-09-18
Affected versions
From: 6.9
Until: 6.10.10
Fixed in: 6.10.10
How to fix this CVE
Update your Linux kernel to version 6.10.10 or later to patch an out-of-bounds vulnerability in BTF name validation that could allow local privilege escalation or system crashes. Systems running kernel versions 6.9 through 6.10.9 should prioritize this update, as the vulnerability bypasses validation checks for malformed BTF names during eBPF program loading.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check your kernel version with `uname -r` and compare against the affected range 6.9.x through 6.10.9
- Step 2: Verify eBPF is enabled on your system by checking `/proc/sys/kernel/unprivileged_bpf_disabled` — if set to 0, eBPF programs can be loaded by unprivileged users
- Step 3: Search system logs for failed BTF validation errors using `grep -i 'btf' /var/log/kern.log` or `journalctl -k | grep btf`
- Step 4: After patching, reboot the system and confirm the new kernel version with `uname -r` to ensure version 6.10.10 or later is running
FAQ
What is CVE-2024-46764?
This vulnerability allows a locally privileged user to trigger an out-of-bounds condition in the Linux kernel's eBPF BTF (BPF Type Format) name validation logic by crafting malformed BTF data with null bytes in invalid positions. The validation function incorrectly accepts these malicious names, potentially leading to memory corruption or privilege escalation.
Is CVE-2024-46764 being actively exploited?
No, this vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public exploits have been disclosed, though proof-of-concept code may exist in private security research.
What versions of Kernel are affected by CVE-2024-46764?
Linux kernel versions 6.9.0 through 6.10.9 are vulnerable; kernel 6.10.10 and later include the fix.
How do I check if my server is vulnerable to CVE-2024-46764?
Run `uname -r` and if the output shows a version between 6.9.0 and 6.10.9, your system is vulnerable. Additionally, verify that eBPF support is enabled with `cat /proc/sys/kernel/unprivileged_bpf_disabled` (value of 0 means unprivileged eBPF is allowed).
Does Defensia detect CVE-2024-46764?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Kernel is installed on a monitored server, CVE-2024-46764 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-46764. Free for 1 server.
Get started free