cve-2024-43910
Vulnerability from cvelistv5
Published
2024-08-26 10:11
Modified
2024-12-19 09:18
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses Currently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to a global function as an argument. The adverse effects of this is that BPF helpers can continue to make use of this modified CONST_PTR_TO_DYNPTR from within the context of the global function, which can unintentionally result in out-of-bounds memory accesses and therefore compromise overall system stability i.e. [ 244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140 [ 244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302 [ 244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533 [ 244.174318] Call Trace: [ 244.175787] <TASK> [ 244.177356] dump_stack_lvl+0x66/0xa0 [ 244.179531] print_report+0xce/0x670 [ 244.182314] ? __virt_addr_valid+0x200/0x3e0 [ 244.184908] kasan_report+0xd7/0x110 [ 244.187408] ? bpf_dynptr_data+0x137/0x140 [ 244.189714] ? bpf_dynptr_data+0x137/0x140 [ 244.192020] bpf_dynptr_data+0x137/0x140 [ 244.194264] bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26 [ 244.198044] bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23 [ 244.202136] bpf_user_ringbuf_drain+0x2c7/0x570 [ 244.204744] ? 0xffffffffc0009e58 [ 244.206593] ? __pfx_bpf_user_ringbuf_drain+0x10/0x10 [ 244.209795] bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b [ 244.215922] bpf_trampoline_6442502480+0x43/0xe3 [ 244.218691] __x64_sys_prlimit64+0x9/0xf0 [ 244.220912] do_syscall_64+0xc1/0x1d0 [ 244.223043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.226458] RIP: 0033:0x7ffa3eb8f059 [ 244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48 [ 244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e [ 244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059 [ 244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0 [ 244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000 [ 244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80 [ 244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000 [ 244.268303] </TASK> Add a check_func_arg_reg_off() to the path in which the BPF verifier verifies the arguments of global function arguments, specifically those which take an argument of type ARG_PTR_TO_DYNPTR | MEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any explicit and strict type matching on the supplied register type, so let's also enforce that a register either type PTR_TO_STACK or CONST_PTR_TO_DYNPTR is by the caller.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874Patch
Impacted products
Vendor Product Version
Linux Linux Version: a64bfe618665ea9c722f922cba8c6e3234eac5ac
Version: a64bfe618665ea9c722f922cba8c6e3234eac5ac
 Create a notification for this product.
   Linux Linux Version: 6.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-43910",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T15:28:19.098639Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-12T17:33:07.162Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "kernel/bpf/verifier.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "13663a7c644bf1dedaf461d07252db5d76c8759a",
                     status: "affected",
                     version: "a64bfe618665ea9c722f922cba8c6e3234eac5ac",
                     versionType: "git",
                  },
                  {
                     lessThan: "ec2b9a5e11e51fea1bb04c1e7e471952e887e874",
                     status: "affected",
                     version: "a64bfe618665ea9c722f922cba8c6e3234eac5ac",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "kernel/bpf/verifier.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.8",
                  },
                  {
                     lessThan: "6.8",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.10.*",
                     status: "unaffected",
                     version: "6.10.5",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.11",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\n\nCurrently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to\na global function as an argument. The adverse effects of this is that\nBPF helpers can continue to make use of this modified\nCONST_PTR_TO_DYNPTR from within the context of the global function,\nwhich can unintentionally result in out-of-bounds memory accesses and\ntherefore compromise overall system stability i.e.\n\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\n[  244.174318] Call Trace:\n[  244.175787]  <TASK>\n[  244.177356]  dump_stack_lvl+0x66/0xa0\n[  244.179531]  print_report+0xce/0x670\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\n[  244.184908]  kasan_report+0xd7/0x110\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\n[  244.192020]  bpf_dynptr_data+0x137/0x140\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\n[  244.204744]  ? 0xffffffffc0009e58\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\n[  244.220912]  do_syscall_64+0xc1/0x1d0\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\n[  244.268303]  </TASK>\n\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\nverifies the arguments of global function arguments, specifically\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\nMEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any\nexplicit and strict type matching on the supplied register type, so\nlet's also enforce that a register either type PTR_TO_STACK or\nCONST_PTR_TO_DYNPTR is by the caller.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:18:16.887Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a",
            },
            {
               url: "https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874",
            },
         ],
         title: "bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-43910",
      datePublished: "2024-08-26T10:11:14.105Z",
      dateReserved: "2024-08-17T09:11:59.294Z",
      dateUpdated: "2024-12-19T09:18:16.887Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-43910\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-26T11:15:05.177\",\"lastModified\":\"2024-09-05T18:30:23.437\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\\n\\nCurrently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to\\na global function as an argument. The adverse effects of this is that\\nBPF helpers can continue to make use of this modified\\nCONST_PTR_TO_DYNPTR from within the context of the global function,\\nwhich can unintentionally result in out-of-bounds memory accesses and\\ntherefore compromise overall system stability i.e.\\n\\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\\n[  244.174318] Call Trace:\\n[  244.175787]  <TASK>\\n[  244.177356]  dump_stack_lvl+0x66/0xa0\\n[  244.179531]  print_report+0xce/0x670\\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\\n[  244.184908]  kasan_report+0xd7/0x110\\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\\n[  244.192020]  bpf_dynptr_data+0x137/0x140\\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\\n[  244.204744]  ? 0xffffffffc0009e58\\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\\n[  244.220912]  do_syscall_64+0xc1/0x1d0\\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\\n[  244.268303]  </TASK>\\n\\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\\nverifies the arguments of global function arguments, specifically\\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\\nMEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any\\nexplicit and strict type matching on the supplied register type, so\\nlet's also enforce that a register either type PTR_TO_STACK or\\nCONST_PTR_TO_DYNPTR is by the caller.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: agrega check_func_arg_reg_off() faltante para evitar accesos a memoria fuera de los límites. Actualmente, es posible pasar un CONST_PTR_TO_DYNPTR modificado a una función global como argumento. Los efectos adversos de esto es que los asistentes de BPF pueden continuar haciendo uso de este CONST_PTR_TO_DYNPTR modificado desde dentro del contexto de la función global, lo que puede resultar involuntariamente en accesos a la memoria fuera de los límites y, por lo tanto, comprometer la estabilidad general del sistema, es decir, [244.157771] ERROR : KASAN: losa fuera de los límites en bpf_dynptr_data+0x137/0x140 [244.161345] Lectura de tamaño 8 en la dirección ffff88810914be68 por tarea test_progs/302 [244.167151] CPU: 0 PID: 302 Comm: test_progs Contaminado: GOE 6.10.0- rc3-00131-g66b586715063 #533 [244.174318] Seguimiento de llamadas: [244.175787]  [244.177356] dump_stack_lvl+0x66/0xa0 [244.179531] print_report+0xce/0x670 [244. 182314] ? __virt_addr_valid+0x200/0x3e0 [ 244.184908] kasan_report+0xd7/0x110 [ 244.187408] ? bpf_dynptr_data+0x137/0x140 [244.189714]? bpf_dynptr_data+0x137/0x140 [ 244.192020] bpf_dynptr_data+0x137/0x140 [ 244.194264] bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26 [ 244. 198044] bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23 [ 244.202136] bpf_user_ringbuf_drain+0x2c7/0x570 [ 244.204744] ? 0xffffffffc0009e58 [244.206593]? __pfx_bpf_user_ringbuf_drain+0x10/0x10 [ 244.209795] bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b [ 244.215922] 2502480+0x43/0xe3 [ 244.218691] __x64_sys_prlimit64+0x9/0xf0 [ 244.220912] do_syscall_64+0xc1/0x1d0 [ 244.223043] Entry_SYSCALL_64_after_hwframe+0x77/0x7f [244.226458] QEPD: 0033:0x7ffa3eb8f059 [ 244.228582] Código: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 d 89 c8 4c 8b 4c 24 08 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48 [ 244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 0000000012e [ 244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059 [ 244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0 [ 244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R 09: 0000000000000000 [ 244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80 [ 244.264201] R13: 000000000000001c R 14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000 [ 244.268303 ]  Agregue un check_func_arg_reg_off() a la ruta en la que el verificador BPF verifica los argumentos de las funciones globales, específicamente aquellos que toman un argumento de tipo ARG_PTR_TO_DYNPTR | MEM_RDONLY. Además, Process_dynptr_func() no parece realizar ninguna coincidencia de tipos explícita y estricta en el tipo de registro proporcionado, por lo que también hagamos cumplir que un registro del tipo PTR_TO_STACK o CONST_PTR_TO_DYNPTR esté a cargo de la persona que llama.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"48E239A0-A959-4FAB-8475-D045FED3DDA5\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43910\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:28:19.098639Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.947Z\"}}], \"cna\": {\"title\": \"bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a64bfe618665\", \"lessThan\": \"13663a7c644b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a64bfe618665\", \"lessThan\": \"ec2b9a5e11e5\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13663a7c644bf1dedaf461d07252db5d76c8759a\"}, {\"url\": \"https://git.kernel.org/stable/c/ec2b9a5e11e51fea1bb04c1e7e471952e887e874\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses\\n\\nCurrently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to\\na global function as an argument. The adverse effects of this is that\\nBPF helpers can continue to make use of this modified\\nCONST_PTR_TO_DYNPTR from within the context of the global function,\\nwhich can unintentionally result in out-of-bounds memory accesses and\\ntherefore compromise overall system stability i.e.\\n\\n[  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140\\n[  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302\\n[  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533\\n[  244.174318] Call Trace:\\n[  244.175787]  <TASK>\\n[  244.177356]  dump_stack_lvl+0x66/0xa0\\n[  244.179531]  print_report+0xce/0x670\\n[  244.182314]  ? __virt_addr_valid+0x200/0x3e0\\n[  244.184908]  kasan_report+0xd7/0x110\\n[  244.187408]  ? bpf_dynptr_data+0x137/0x140\\n[  244.189714]  ? bpf_dynptr_data+0x137/0x140\\n[  244.192020]  bpf_dynptr_data+0x137/0x140\\n[  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26\\n[  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23\\n[  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570\\n[  244.204744]  ? 0xffffffffc0009e58\\n[  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10\\n[  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b\\n[  244.215922]  bpf_trampoline_6442502480+0x43/0xe3\\n[  244.218691]  __x64_sys_prlimit64+0x9/0xf0\\n[  244.220912]  do_syscall_64+0xc1/0x1d0\\n[  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  244.226458] RIP: 0033:0x7ffa3eb8f059\\n[  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48\\n[  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e\\n[  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059\\n[  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0\\n[  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000\\n[  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80\\n[  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000\\n[  244.268303]  </TASK>\\n\\nAdd a check_func_arg_reg_off() to the path in which the BPF verifier\\nverifies the arguments of global function arguments, specifically\\nthose which take an argument of type ARG_PTR_TO_DYNPTR |\\nMEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any\\nexplicit and strict type matching on the supplied register type, so\\nlet's also enforce that a register either type PTR_TO_STACK or\\nCONST_PTR_TO_DYNPTR is by the caller.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-09-15T17:55:22.283Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-43910\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-15T17:55:22.283Z\", \"dateReserved\": \"2024-08-17T09:11:59.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:11:14.105Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.