| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42063: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode |
| |
| syzbot reported uninit memory usages during map_{lookup,delete}_elem. |
| |
| ========== |
| BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] |
| BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 |
| __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] |
| dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 |
| ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline] |
| bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38 |
| ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 |
| __bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237 |
| ========== |
| |
| The reproducer should be in the interpreter mode. |
| |
| The C reproducer is trying to run the following bpf prog: |
| |
| 0: (18) r0 = 0x0 |
| 2: (18) r1 = map[id:49] |
| 4: (b7) r8 = 16777216 |
| 5: (7b) *(u64 *)(r10 -8) = r8 |
| 6: (bf) r2 = r10 |
| 7: (07) r2 += -229 |
| ^^^^^^^^^^ |
| |
| 8: (b7) r3 = 8 |
| 9: (b7) r4 = 0 |
| 10: (85) call dev_map_lookup_elem#1543472 |
| 11: (95) exit |
| |
| It is due to the "void *key" (r2) passed to the helper. bpf allows uninit |
| stack memory access for bpf prog with the right privileges. This patch |
| uses kmsan_unpoison_memory() to mark the stack as initialized. |
| |
| This should address different syzbot reports on the uninit "void *key" |
| argument during map_{lookup,delete}_elem. |
| |
| The Linux kernel CVE team has assigned CVE-2024-42063 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 6.1.97 with commit b30f3197a6cd080052d5d4973f9a6b479fd9fff5 |
| Fixed in 6.6.37 with commit d812ae6e02bd6e6a9cd1fdb09519c2f33e875faf |
| Fixed in 6.9.8 with commit 3189983c26108cf0990e5c46856dc9feb9470d12 |
| Fixed in 6.10 with commit e8742081db7d01f980c6161ae1e8a1dbc1e30979 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42063 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| kernel/bpf/core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/b30f3197a6cd080052d5d4973f9a6b479fd9fff5 |
| https://git.kernel.org/stable/c/d812ae6e02bd6e6a9cd1fdb09519c2f33e875faf |
| https://git.kernel.org/stable/c/3189983c26108cf0990e5c46856dc9feb9470d12 |
| https://git.kernel.org/stable/c/e8742081db7d01f980c6161ae1e8a1dbc1e30979 |
