cve/published/2024/CVE-2024-56702.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-56702: bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

 Arguments to a raw tracepoint are tagged as trusted, which carries the
 semantics that the pointer will be non-NULL.  However, in certain cases,
 a raw tracepoint argument may end up being NULL. More context about this
 issue is available in [0].

 Thus, there is a discrepancy between the reality, that raw_tp arguments
 can actually be NULL, and the verifier's knowledge, that they are never
 NULL, causing explicit NULL checks to be deleted, and accesses to such
 pointers potentially crashing the kernel.

 To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special
 case the dereference and pointer arithmetic to permit it, and allow
 passing them into helpers/kfuncs; these exceptions are made for raw_tp
 programs only. Ensure that we don't do this when ref_obj_id > 0, as in
 that case this is an acquired object and doesn't need such adjustment.

 The reason we do mask_raw_tp_trusted_reg logic is because other will
 recheck in places whether the register is a trusted_reg, and then
 consider our register as untrusted when detecting the presence of the
 PTR_MAYBE_NULL flag.

 To allow safe dereference, we enable PROBE_MEM marking when we see loads
 into trusted pointers with PTR_MAYBE_NULL.

 While trusted raw_tp arguments can also be passed into helpers or kfuncs
 where such broken assumption may cause issues, a future patch set will
 tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can
 already be passed into helpers and causes similar problems. Thus, they
 are left alone for now.

 It is possible that these checks also permit passing non-raw_tp args
 that are trusted PTR_TO_BTF_ID with null marking. In such a case,
 allowing dereference when pointer is NULL expands allowed behavior, so
 won't regress existing programs, and the case of passing these into
 helpers is the same as above and will be dealt with later.

 Also update the failure case in tp_btf_nullable selftest to capture the
 new behavior, as the verifier will no longer cause an error when
 directly dereference a raw tracepoint argument marked as __nullable.

   [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb

 The Linux kernel CVE team has assigned CVE-2024-56702 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.11.11 with commit c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6
 	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.12.2 with commit 3634d4a310820567fc634bf8f1ee2b91378773e8
 	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.13 with commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-56702
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	include/linux/bpf.h
 	kernel/bpf/btf.c
 	kernel/bpf/verifier.c
 	tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6
 	https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8
 	https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094d
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-56702: bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

	Arguments to a raw tracepoint are tagged as trusted, which carries the
	semantics that the pointer will be non-NULL. However, in certain cases,
	a raw tracepoint argument may end up being NULL. More context about this
	issue is available in [0].

	Thus, there is a discrepancy between the reality, that raw_tp arguments
	can actually be NULL, and the verifier's knowledge, that they are never
	NULL, causing explicit NULL checks to be deleted, and accesses to such
	pointers potentially crashing the kernel.

	To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special
	case the dereference and pointer arithmetic to permit it, and allow
	passing them into helpers/kfuncs; these exceptions are made for raw_tp
	programs only. Ensure that we don't do this when ref_obj_id > 0, as in
	that case this is an acquired object and doesn't need such adjustment.

	The reason we do mask_raw_tp_trusted_reg logic is because other will
	recheck in places whether the register is a trusted_reg, and then
	consider our register as untrusted when detecting the presence of the
	PTR_MAYBE_NULL flag.

	To allow safe dereference, we enable PROBE_MEM marking when we see loads
	into trusted pointers with PTR_MAYBE_NULL.

	While trusted raw_tp arguments can also be passed into helpers or kfuncs
	where such broken assumption may cause issues, a future patch set will
	tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can
	already be passed into helpers and causes similar problems. Thus, they
	are left alone for now.

	It is possible that these checks also permit passing non-raw_tp args
	that are trusted PTR_TO_BTF_ID with null marking. In such a case,
	allowing dereference when pointer is NULL expands allowed behavior, so
	won't regress existing programs, and the case of passing these into
	helpers is the same as above and will be dealt with later.

	Also update the failure case in tp_btf_nullable selftest to capture the
	new behavior, as the verifier will no longer cause an error when
	directly dereference a raw tracepoint argument marked as __nullable.

	[0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb

	The Linux kernel CVE team has assigned CVE-2024-56702 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.11.11 with commit c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6
	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.12.2 with commit 3634d4a310820567fc634bf8f1ee2b91378773e8
	Issue introduced in 6.2 with commit 3f00c52393445ed49aadc1a567aa502c6333b1a1 and fixed in 6.13 with commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56702
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	include/linux/bpf.h
	kernel/bpf/btf.c
	kernel/bpf/verifier.c
	tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6
	https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8
	https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094d