cve/published/2024/CVE-2024-50163.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Make sure internal and UAPI bpf_redirect flags don't overlap

The bpf_redirect_info is shared between the SKB and XDP redirect paths,
and the two paths use the same numeric flag values in the ri->flags
field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that
if skb bpf_redirect_neigh() is used with a non-NULL params argument and,
subsequently, an XDP redirect is performed using the same
bpf_redirect_info struct, the XDP path will get confused and end up
crashing, which syzbot managed to trigger.

With the stack-allocated bpf_redirect_info, the structure is no longer
shared between the SKB and XDP paths, so the crash doesn't happen
anymore. However, different code paths using identically-numbered flag
values in the same struct field still seems like a bit of a mess, so
this patch cleans that up by moving the flag definitions together and
redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap
with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make
sure the overlap is not re-introduced by mistake.

The Linux kernel CVE team has assigned CVE-2024-50163 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit e624d4ed4aa8cc3c69d1359b0aaea539203ed266 and fixed in 5.15.170 with commit 4e1e428533845d48828bd3875c0e92e8565b9962
	Issue introduced in 5.14 with commit e624d4ed4aa8cc3c69d1359b0aaea539203ed266 and fixed in 6.1.115 with commit 314dbee9fe4f5cee36435465de52c988d7caa466
	Issue introduced in 5.14 with commit e624d4ed4aa8cc3c69d1359b0aaea539203ed266 and fixed in 6.6.59 with commit 0fca5ed4be8e8bfbfb9bd97845af596bab7192d3
	Issue introduced in 5.14 with commit e624d4ed4aa8cc3c69d1359b0aaea539203ed266 and fixed in 6.11.6 with commit cec288e05ceac9a0d3a3a1fd279534b11844c826
	Issue introduced in 5.14 with commit e624d4ed4aa8cc3c69d1359b0aaea539203ed266 and fixed in 6.12 with commit 09d88791c7cd888d5195c84733caf9183dcfbd16

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-50163
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/uapi/linux/bpf.h
	net/core/filter.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962
	https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466
	https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3
	https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826
	https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16