cve/published/2024/CVE-2024-42161.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-42161: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

[Changes from V1:
 - Use a default branch in the switch statement to initialize `val'.]

GCC warns that `val' may be used uninitialized in the
BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:

	[...]
	unsigned long long val;						      \
	[...]								      \
	switch (__CORE_RELO(s, field, BYTE_SIZE)) {			      \
	case 1: val = *(const unsigned char *)p; break;			      \
	case 2: val = *(const unsigned short *)p; break;		      \
	case 4: val = *(const unsigned int *)p; break;			      \
	case 8: val = *(const unsigned long long *)p; break;		      \
        }       							      \
	[...]
	val;								      \
	}								      \

This patch adds a default entry in the switch statement that sets
`val' to zero in order to avoid the warning, and random values to be
used in case __builtin_preserve_field_info returns unexpected values
for BPF_FIELD_BYTE_SIZE.

Tested in bpf-next master.
No regressions.

The Linux kernel CVE team has assigned CVE-2024-42161 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.222 with commit b694989bb13ed5f166e633faa1eb0f21c6d261a6
	Fixed in 5.15.163 with commit 3364c2ed1c241989847f19cf83e3db903ce689e3
	Fixed in 6.1.98 with commit a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
	Fixed in 6.6.39 with commit 7e5471b5efebc30dd0bc035cda86693a5c73d45f
	Fixed in 6.9.9 with commit ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
	Fixed in 6.10 with commit 009367099eb61a4fc2af44d4eb06b6b4de7de6db

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-42161
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	tools/lib/bpf/bpf_core_read.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6
	https://git.kernel.org/stable/c/3364c2ed1c241989847f19cf83e3db903ce689e3
	https://git.kernel.org/stable/c/a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
	https://git.kernel.org/stable/c/7e5471b5efebc30dd0bc035cda86693a5c73d45f
	https://git.kernel.org/stable/c/ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
	https://git.kernel.org/stable/c/009367099eb61a4fc2af44d4eb06b6b4de7de6db