CVE-2024-38574

5.5 · MEDIUM

Published Jun 19, 2024 linux CWE-476 EPSS 0.22% (13th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-38574 is a medium-severity vulnerability affecting linux linux_kernel. It was published on June 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Prevent null-pointer dereference when prog to load has no BTF

In bpf_objec_load_prog(), there's no guarantee that obj->btf is non-NULL

when passing it to btf__fd(), and this function does not perform any

check before dereferencing its argument (as bpf_object__btf_fd() used to

do). As a consequence, we get segmentation fault errors in bpftool (for

example) when trying to load programs that come without BTF information.

v2: Keep btf__fd() in the fix instead of reverting to bpf_object__btf_fd().

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 6.8, < 6.8.12	Affected

References

Ref git.kernel.org/stable/c/1fd91360a75833b7110af9834ae26c977e1273e0 Ref git.kernel.org/stable/c/9bf48fa19a4b1d186e08b20bf7e5de26a15644fb Ref git.kernel.org/stable/c/ef80b59acfa4dee4b5eaccb15572b69248831104 Ref git.kernel.org/stable/c/1fd91360a75833b7110af9834ae26c977e1273e0 Ref git.kernel.org/stable/c/9bf48fa19a4b1d186e08b20bf7e5de26a15644fb Ref git.kernel.org/stable/c/ef80b59acfa4dee4b5eaccb15572b69248831104

Frequently Asked Questions

What is CVE-2024-38574?

CVE-2024-38574 is a medium-severity vulnerability affecting linux linux_kernel. It was published on June 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-38574?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-38574?

How can CyberStrike help with CVE-2024-38574?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-38574 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719