cve-2024-42072
Vulnerability from cvelistv5
Published
2024-07-29 15:52
Modified
2024-12-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix may_goto with negative offset. Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto. The 1st bug is the way may_goto is patched. When offset is negative it should be patched differently. The 2nd bug is in the verifier: when current state may_goto_depth is equal to visited state may_goto_depth it means there is an actual infinite loop. It's not correct to prune exploration of the program at this point. Note, that this check doesn't limit the program to only one may_goto insn, since 2nd and any further may_goto will increment may_goto_depth only in the queued state pushed for future exploration. The current state will have may_goto_depth == 0 regardless of number of may_goto insns and the verifier has to explore the program until bpf_exit.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103Patch
Impacted products
Vendor Product Version
Linux Linux Version: 011832b97b311bb9e3c27945bc0d1089a14209c9
Version: 011832b97b311bb9e3c27945bc0d1089a14209c9
 Create a notification for this product.
   Linux Linux Version: 6.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:31.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:19:39.749938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:57.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "175827e04f4be53f3dfb57edf12d0d49b18fd939",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            },
            {
              "lessThan": "2b2efe1937ca9f8815884bd4dcd5b32733025103",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix may_goto with negative offset.\n\nZac\u0027s syzbot crafted a bpf prog that exposed two bugs in may_goto.\nThe 1st bug is the way may_goto is patched. When offset is negative\nit should be patched differently.\nThe 2nd bug is in the verifier:\nwhen current state may_goto_depth is equal to visited state may_goto_depth\nit means there is an actual infinite loop. It\u0027s not correct to prune\nexploration of the program at this point.\nNote, that this check doesn\u0027t limit the program to only one may_goto insn,\nsince 2nd and any further may_goto will increment may_goto_depth only\nin the queued state pushed for future exploration. The current state\nwill have may_goto_depth == 0 regardless of number of may_goto insns\nand the verifier has to explore the program until bpf_exit."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:12:11.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103"
        }
      ],
      "title": "bpf: Fix may_goto with negative offset.",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42072",
    "datePublished": "2024-07-29T15:52:35.598Z",
    "dateReserved": "2024-07-29T15:50:41.168Z",
    "dateUpdated": "2024-12-19T09:12:11.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42072\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T16:15:06.693\",\"lastModified\":\"2024-11-21T09:33:32.037\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix may_goto with negative offset.\\n\\nZac\u0027s syzbot crafted a bpf prog that exposed two bugs in may_goto.\\nThe 1st bug is the way may_goto is patched. When offset is negative\\nit should be patched differently.\\nThe 2nd bug is in the verifier:\\nwhen current state may_goto_depth is equal to visited state may_goto_depth\\nit means there is an actual infinite loop. It\u0027s not correct to prune\\nexploration of the program at this point.\\nNote, that this check doesn\u0027t limit the program to only one may_goto insn,\\nsince 2nd and any further may_goto will increment may_goto_depth only\\nin the queued state pushed for future exploration. The current state\\nwill have may_goto_depth == 0 regardless of number of may_goto insns\\nand the verifier has to explore the program until bpf_exit.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bpf: corrige may_goto con desplazamiento negativo. El syzbot de Zac cre\u00f3 un programa bpf que expuso dos errores en may_goto. El primer error es la forma en que se parchea may_goto. Cuando el desplazamiento es negativo, se debe parchear de manera diferente. El segundo error est\u00e1 en el verificador: cuando el estado actual may_goto_ Depth es igual al estado visitado may_goto_ Depth, significa que hay un bucle infinito real. No es correcto podar la exploraci\u00f3n del programa en este momento. Tenga en cuenta que esta verificaci\u00f3n no limita el programa a solo un may_goto insn, ya que el segundo may_goto y cualquier otro may_goto incrementar\u00e1 may_goto_profundidad solo en el estado en cola enviado para exploraci\u00f3n futura. El estado actual tendr\u00e1 may_goto_ Depth == 0 independientemente del n\u00famero de may_goto insns y el verificador tiene que explorar el programa hasta bpf_exit.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.9\",\"matchCriteriaId\":\"18FE1EAE-C36C-49FC-A5E0-0A661CDC561E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.1\",\"versionEndExcluding\":\"6.9.8\",\"matchCriteriaId\":\"1557DCF8-46D3-4910-8B19-5C77412AB681\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:31.986Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42072\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:19:39.749938Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.890Z\"}}], \"cna\": {\"title\": \"bpf: Fix may_goto with negative offset.\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"011832b97b31\", \"lessThan\": \"175827e04f4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"011832b97b31\", \"lessThan\": \"2b2efe1937ca\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939\"}, {\"url\": \"https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix may_goto with negative offset.\\n\\nZac\u0027s syzbot crafted a bpf prog that exposed two bugs in may_goto.\\nThe 1st bug is the way may_goto is patched. When offset is negative\\nit should be patched differently.\\nThe 2nd bug is in the verifier:\\nwhen current state may_goto_depth is equal to visited state may_goto_depth\\nit means there is an actual infinite loop. It\u0027s not correct to prune\\nexploration of the program at this point.\\nNote, that this check doesn\u0027t limit the program to only one may_goto insn,\\nsince 2nd and any further may_goto will increment may_goto_depth only\\nin the queued state pushed for future exploration. The current state\\nwill have may_goto_depth == 0 regardless of number of may_goto insns\\nand the verifier has to explore the program until bpf_exit.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:36:51.418Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42072\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:36:51.418Z\", \"dateReserved\": \"2024-07-29T15:50:41.168Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T15:52:35.598Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.