| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-58100: bpf: check changes_pkt_data property for extension programs |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| bpf: check changes_pkt_data property for extension programs |
| |
| When processing calls to global sub-programs, verifier decides whether |
| to invalidate all packet pointers in current state depending on the |
| changes_pkt_data property of the global sub-program. |
| |
| Because of this, an extension program replacing a global sub-program |
| must be compatible with changes_pkt_data property of the sub-program |
| being replaced. |
| |
| This commit: |
| - adds changes_pkt_data flag to struct bpf_prog_aux: |
| - this flag is set in check_cfg() for main sub-program; |
| - in jit_subprogs() for other sub-programs; |
| - modifies bpf_check_attach_btf_id() to check changes_pkt_data flag; |
| - moves call to check_attach_btf_id() after the call to check_cfg(), |
| because it needs changes_pkt_data flag to be set: |
| |
| bpf_check: |
| ... ... |
| - check_attach_btf_id resolve_pseudo_ldimm64 |
| resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded |
| bpf_prog_is_offloaded check_cfg |
| check_cfg + check_attach_btf_id |
| ... ... |
| |
| The following fields are set by check_attach_btf_id(): |
| - env->ops |
| - prog->aux->attach_btf_trace |
| - prog->aux->attach_func_name |
| - prog->aux->attach_func_proto |
| - prog->aux->dst_trampoline |
| - prog->aux->mod |
| - prog->aux->saved_dst_attach_type |
| - prog->aux->saved_dst_prog_type |
| - prog->expected_attach_type |
| |
| Neither of these fields are used by resolve_pseudo_ldimm64() or |
| bpf_prog_offload_verifier_prep() (for netronome and netdevsim |
| drivers), so the reordering is safe. |
| |
| The Linux kernel CVE team has assigned CVE-2024-58100 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.6 with commit be8704ff07d2374bcc5c675526f95e70c6459683 and fixed in 6.6.90 with commit 7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7 |
| Issue introduced in 5.6 with commit be8704ff07d2374bcc5c675526f95e70c6459683 and fixed in 6.12.25 with commit 3846e2bea565ee1c5195dcc625fda9868fb0e3b3 |
| Issue introduced in 5.6 with commit be8704ff07d2374bcc5c675526f95e70c6459683 and fixed in 6.13 with commit 81f6d0530ba031b5f038a091619bf2ff29568852 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-58100 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/linux/bpf.h |
| kernel/bpf/verifier.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7 |
| https://git.kernel.org/stable/c/3846e2bea565ee1c5195dcc625fda9868fb0e3b3 |
| https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852 |
