Bottlerocket: bottlerocket-kernel-6.1, kernel-6.1: security update to 6.1.124

high Tenable Cloud Security Plugin ID 428130

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only
maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it
was still possible to write into it from a BPF program side through specific helpers having
ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the
meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as
register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the
BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} |
MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that
it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However,
ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment
requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and
reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these
helpers write directly into the args via *<ptr> = val. The .arg*_size has been initialized reflecting the
actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument
types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore
cannot blindly write *<ptr> = val. (CVE-2024-49861)

Plugin Details

Severity: High

ID: 428130

Version: Revision 1.2

Type: Local

Family: Bottlerocket Local Security Checks

Published: 6/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2024-49861

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/21/2024

Reference Information

CVE: CVE-2024-49861

Detections

Analytics