https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:07:08 +0000 https://cve.radiocsirt.org/vuln/cve-2024-36937 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xdp: use flags field to disambiguate broadcast redirect</p> <p>When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.</p> <p>When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the &#39;map&#39; pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it&#39;s dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don&#39;t have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().</p> <p>To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the &#39;flags&#39; value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xdp: use flags field to disambiguate broadcast redirect</p> <p>When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.</p> <p>When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the &#39;map&#39; pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it&#39;s dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don&#39;t have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().</p> <p>To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the &#39;flags&#39; value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read…</p> https://cve.radiocsirt.org/vuln/cve-2024-36937