cve-2024-56702
Vulnerability from cvelistv5
Published
2024-12-28 09:46
Modified
2025-01-20 06:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Arguments to a raw tracepoint are tagged as trusted, which carries the semantics that the pointer will be non-NULL. However, in certain cases, a raw tracepoint argument may end up being NULL. More context about this issue is available in [0]. Thus, there is a discrepancy between the reality, that raw_tp arguments can actually be NULL, and the verifier's knowledge, that they are never NULL, causing explicit NULL checks to be deleted, and accesses to such pointers potentially crashing the kernel. To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special case the dereference and pointer arithmetic to permit it, and allow passing them into helpers/kfuncs; these exceptions are made for raw_tp programs only. Ensure that we don't do this when ref_obj_id > 0, as in that case this is an acquired object and doesn't need such adjustment. The reason we do mask_raw_tp_trusted_reg logic is because other will recheck in places whether the register is a trusted_reg, and then consider our register as untrusted when detecting the presence of the PTR_MAYBE_NULL flag. To allow safe dereference, we enable PROBE_MEM marking when we see loads into trusted pointers with PTR_MAYBE_NULL. While trusted raw_tp arguments can also be passed into helpers or kfuncs where such broken assumption may cause issues, a future patch set will tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can already be passed into helpers and causes similar problems. Thus, they are left alone for now. It is possible that these checks also permit passing non-raw_tp args that are trusted PTR_TO_BTF_ID with null marking. In such a case, allowing dereference when pointer is NULL expands allowed behavior, so won't regress existing programs, and the case of passing these into helpers is the same as above and will be dealt with later. Also update the failure case in tp_btf_nullable selftest to capture the new behavior, as the verifier will no longer cause an error when directly dereference a raw tracepoint argument marked as __nullable. [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094dPatch
Impacted products
Vendor Product Version
Linux Linux Version: 3f00c52393445ed49aadc1a567aa502c6333b1a1
Version: 3f00c52393445ed49aadc1a567aa502c6333b1a1
Version: 3f00c52393445ed49aadc1a567aa502c6333b1a1
 Create a notification for this product.
   Linux Linux Version: 6.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "include/linux/bpf.h",
                  "kernel/bpf/btf.c",
                  "kernel/bpf/verifier.c",
                  "tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6",
                     status: "affected",
                     version: "3f00c52393445ed49aadc1a567aa502c6333b1a1",
                     versionType: "git",
                  },
                  {
                     lessThan: "3634d4a310820567fc634bf8f1ee2b91378773e8",
                     status: "affected",
                     version: "3f00c52393445ed49aadc1a567aa502c6333b1a1",
                     versionType: "git",
                  },
                  {
                     lessThan: "cb4158ce8ec8a5bb528cc1693356a5eb8058094d",
                     status: "affected",
                     version: "3f00c52393445ed49aadc1a567aa502c6333b1a1",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "include/linux/bpf.h",
                  "kernel/bpf/btf.c",
                  "kernel/bpf/verifier.c",
                  "tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.2",
                  },
                  {
                     lessThan: "6.2",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.11",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.12.*",
                     status: "unaffected",
                     version: "6.12.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.13",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark raw_tp arguments with PTR_MAYBE_NULL\n\nArguments to a raw tracepoint are tagged as trusted, which carries the\nsemantics that the pointer will be non-NULL.  However, in certain cases,\na raw tracepoint argument may end up being NULL. More context about this\nissue is available in [0].\n\nThus, there is a discrepancy between the reality, that raw_tp arguments\ncan actually be NULL, and the verifier's knowledge, that they are never\nNULL, causing explicit NULL checks to be deleted, and accesses to such\npointers potentially crashing the kernel.\n\nTo fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special\ncase the dereference and pointer arithmetic to permit it, and allow\npassing them into helpers/kfuncs; these exceptions are made for raw_tp\nprograms only. Ensure that we don't do this when ref_obj_id > 0, as in\nthat case this is an acquired object and doesn't need such adjustment.\n\nThe reason we do mask_raw_tp_trusted_reg logic is because other will\nrecheck in places whether the register is a trusted_reg, and then\nconsider our register as untrusted when detecting the presence of the\nPTR_MAYBE_NULL flag.\n\nTo allow safe dereference, we enable PROBE_MEM marking when we see loads\ninto trusted pointers with PTR_MAYBE_NULL.\n\nWhile trusted raw_tp arguments can also be passed into helpers or kfuncs\nwhere such broken assumption may cause issues, a future patch set will\ntackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can\nalready be passed into helpers and causes similar problems. Thus, they\nare left alone for now.\n\nIt is possible that these checks also permit passing non-raw_tp args\nthat are trusted PTR_TO_BTF_ID with null marking. In such a case,\nallowing dereference when pointer is NULL expands allowed behavior, so\nwon't regress existing programs, and the case of passing these into\nhelpers is the same as above and will be dealt with later.\n\nAlso update the failure case in tp_btf_nullable selftest to capture the\nnew behavior, as the verifier will no longer cause an error when\ndirectly dereference a raw tracepoint argument marked as __nullable.\n\n  [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-20T06:26:30.388Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6",
            },
            {
               url: "https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8",
            },
            {
               url: "https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094d",
            },
         ],
         title: "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-56702",
      datePublished: "2024-12-28T09:46:24.244Z",
      dateReserved: "2024-12-27T15:00:39.856Z",
      dateUpdated: "2025-01-20T06:26:30.388Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-56702\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:17.980\",\"lastModified\":\"2025-02-03T15:14:18.797\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Mark raw_tp arguments with PTR_MAYBE_NULL\\n\\nArguments to a raw tracepoint are tagged as trusted, which carries the\\nsemantics that the pointer will be non-NULL.  However, in certain cases,\\na raw tracepoint argument may end up being NULL. More context about this\\nissue is available in [0].\\n\\nThus, there is a discrepancy between the reality, that raw_tp arguments\\ncan actually be NULL, and the verifier's knowledge, that they are never\\nNULL, causing explicit NULL checks to be deleted, and accesses to such\\npointers potentially crashing the kernel.\\n\\nTo fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special\\ncase the dereference and pointer arithmetic to permit it, and allow\\npassing them into helpers/kfuncs; these exceptions are made for raw_tp\\nprograms only. Ensure that we don't do this when ref_obj_id > 0, as in\\nthat case this is an acquired object and doesn't need such adjustment.\\n\\nThe reason we do mask_raw_tp_trusted_reg logic is because other will\\nrecheck in places whether the register is a trusted_reg, and then\\nconsider our register as untrusted when detecting the presence of the\\nPTR_MAYBE_NULL flag.\\n\\nTo allow safe dereference, we enable PROBE_MEM marking when we see loads\\ninto trusted pointers with PTR_MAYBE_NULL.\\n\\nWhile trusted raw_tp arguments can also be passed into helpers or kfuncs\\nwhere such broken assumption may cause issues, a future patch set will\\ntackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can\\nalready be passed into helpers and causes similar problems. Thus, they\\nare left alone for now.\\n\\nIt is possible that these checks also permit passing non-raw_tp args\\nthat are trusted PTR_TO_BTF_ID with null marking. In such a case,\\nallowing dereference when pointer is NULL expands allowed behavior, so\\nwon't regress existing programs, and the case of passing these into\\nhelpers is the same as above and will be dealt with later.\\n\\nAlso update the failure case in tp_btf_nullable selftest to capture the\\nnew behavior, as the verifier will no longer cause an error when\\ndirectly dereference a raw tracepoint argument marked as __nullable.\\n\\n  [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Marcar argumentos raw_tp con PTR_MAYBE_NULL Los argumentos para un tracepoint sin procesar se etiquetan como confiables, lo que conlleva la semántica de que el puntero no será NULL. Sin embargo, en ciertos casos, un argumento de tracepoint sin procesar puede terminar siendo NULL. Hay más contexto disponible sobre este problema en [0]. Por lo tanto, existe una discrepancia entre la realidad, que los argumentos raw_tp pueden ser NULL, y el conocimiento del verificador, de que nunca son NULL, lo que hace que se eliminen las comprobaciones NULL explícitas y los accesos a dichos punteros potencialmente bloqueen el kernel. Para solucionar esto, marque los argumentos raw_tp como PTR_MAYBE_NULL y luego aplique un caso especial a la desreferencia y la aritmética de punteros para permitirlo, y permita pasarlos a ayudantes/kfuncs; estas excepciones se realizan solo para programas raw_tp. Asegúrese de no hacer esto cuando ref_obj_id > 0, ya que en ese caso se trata de un objeto adquirido y no necesita dicho ajuste. La razón por la que hacemos la lógica mask_raw_tp_trusted_reg es porque otros volverán a verificar en algunos lugares si el registro es un trusted_reg y luego considerarán nuestro registro como no confiable al detectar la presencia del indicador PTR_MAYBE_NULL. Para permitir una desreferencia segura, habilitamos el marcado PROBE_MEM cuando vemos cargas en punteros confiables con PTR_MAYBE_NULL. Si bien los argumentos raw_tp confiables también se pueden pasar a los ayudantes o kfuncs donde tal suposición rota puede causar problemas, un futuro conjunto de parches abordará su caso por separado, ya que PTR_TO_BTF_ID (sin PTR_TRUSTED) ya se puede pasar a los ayudantes y causa problemas similares. Por lo tanto, se dejan solos por ahora. Es posible que estas verificaciones también permitan pasar argumentos que no sean raw_tp que sean PTR_TO_BTF_ID confiables con marcado nulo. En tal caso, permitir la desreferencia cuando el puntero es NULL expande el comportamiento permitido, por lo que no se producirá una regresión de los programas existentes, y el caso de pasarlos a los ayudantes es el mismo que el anterior y se tratará más adelante. También actualice el caso de falla en la autoprueba tp_btf_nullable para capturar el nuevo comportamiento, ya que el verificador ya no provocará un error cuando desreferencia directamente un argumento de punto de seguimiento sin formato marcado como __nullable. [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"A5EC3EA5-C348-4DEA-A771-70965BB6CE47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.