CVE-2024-38662

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash. We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1	Mailing List Patch
https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9	Mailing List Patch
https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d	Mailing List Patch
https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e	Mailing List Patch
https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d	Mailing List Patch
https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c	Mailing List Patch
https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1	Mailing List Patch
https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9	Mailing List Patch
https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d	Mailing List Patch
https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e	Mailing List Patch
https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d	Mailing List Patch
https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c	Mailing List Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.10.0:rc1::::::

History

21 Nov 2024, 09:26

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1 - Mailing List, Patch~~	() https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1 - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9 - Mailing List, Patch~~	() https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9 - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d - Mailing List, Patch~~	() https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e - Mailing List, Patch~~	() https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d - Mailing List, Patch~~	() https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c - Mailing List, Patch~~	() https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c - Mailing List, Patch

24 Jun 2024, 18:34

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1 -~~	() https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1 - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9 -~~	() https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9 - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d -~~	() https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e -~~	() https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d -~~	() https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d - Mailing List, Patch
References	~~() https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c -~~	() https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c - Mailing List, Patch
First Time		Linux Linux linux Kernel
Summary		(es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: permitir la eliminación de sockmap/sockhash solo si se permite la actualización. Hemos visto una afluencia de informes de syzkaller donde un programa BPF adjunto a un punto de seguimiento desencadena una violación de la regla de bloqueo al realizar un map_delete en un mapa de calcetines/sockhash. No pretendemos apoyar este escenario de uso artificial. Amplíe la verificación de tipo de programa permitido del verificador existente para actualizar sockmap/sockhash para cubrir también la eliminación de un mapa. De ahora en adelante, sólo los programas BPF a los que anteriormente se les permitía actualizar sockmap/sockhash pueden eliminar de estos tipos de mapas.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.7
CPE		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.10.0:rc1::::::
CWE		NVD-CWE-noinfo

21 Jun 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-21 12:15

Updated : 2024-11-21 09:26

NVD link : CVE-2024-38662

Mitre link : CVE-2024-38662

CVE.ORG link : CVE-2024-38662

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

4.7 /10