Detections
Analytics

Google: sys-kernel/csql-kernel-6_6: security update to 19165.0.0

medium Tenable Self-Hosted Container Security Plugin ID 452316

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tailcall infinite loop
 caused by freplace There is a potential infinite loop issue that can occur when using a combination of
 tail calls and freplace. In an upcoming selftest, the attach target for entry_freplace of
 tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in entry_freplace leads to
 entry_tc. This results in an infinite loop: entry_tc -> subprog_tc -> entry_freplace --tailcall->
 entry_tc. The problem arises because the tail_call_cnt in entry_freplace resets to zero each time
 entry_freplace is executed, causing the tail call mechanism to never terminate, eventually leading to a
 kernel panic. To fix this issue, the solution is twofold: 1. Prevent updating a program extended by an
 freplace program to a prog_array map. 2. Prevent extending a program that is already part of a prog_array
 map with an freplace program. This ensures that: * If a program or its subprogram has been extended by an
 freplace program, it can no longer be updated to a prog_array map. * If a program has been added to a
 prog_array map, neither it nor its subprograms can be extended by an freplace program. Moreover, an
 extension program should not be tailcalled. As such, return -EINVAL if the program has a type of
 BPF_PROG_TYPE_EXT when adding it to a prog_array map. Additionally, fix a minor code style issue by
 replacing eight spaces with a tab for proper formatting. (CVE-2024-47794)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 19165.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 452316

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.07

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-47794

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/11/2025

Reference Information

CVE: CVE-2024-47794