CVE-2024-26883

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26883
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0971126c8164abe2004b8536b49690a0d6005b0a Patch
https://git.kernel.org/stable/c/15641007df0f0d35fa28742b25c2a7db9dcd6895 Patch
https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d Patch
https://git.kernel.org/stable/c/43f798b9036491fb014b55dd61c4c5c3193267d0 Patch
https://git.kernel.org/stable/c/7070b274c7866a4c5036f8d54fcaf315c64ac33a Patch
https://git.kernel.org/stable/c/7a4b21250bf79eef26543d35bd390448646c536b Patch
https://git.kernel.org/stable/c/ca1f06e72dec41ae4f76e7b1a8a97265447b46ae Patch
https://git.kernel.org/stable/c/d0e214acc59145ce25113f617311aa79dda39cb3 Patch
https://git.kernel.org/stable/c/f06899582ccee09bd85d0696290e3eaca9aa042d Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

29 Apr 2024, 20:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0971126c8164abe2004b8536b49690a0d6005b0a - () https://git.kernel.org/stable/c/0971126c8164abe2004b8536b49690a0d6005b0a - Patch
References () https://git.kernel.org/stable/c/15641007df0f0d35fa28742b25c2a7db9dcd6895 - () https://git.kernel.org/stable/c/15641007df0f0d35fa28742b25c2a7db9dcd6895 - Patch
References () https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d - () https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d - Patch
References () https://git.kernel.org/stable/c/43f798b9036491fb014b55dd61c4c5c3193267d0 - () https://git.kernel.org/stable/c/43f798b9036491fb014b55dd61c4c5c3193267d0 - Patch
References () https://git.kernel.org/stable/c/7070b274c7866a4c5036f8d54fcaf315c64ac33a - () https://git.kernel.org/stable/c/7070b274c7866a4c5036f8d54fcaf315c64ac33a - Patch
References () https://git.kernel.org/stable/c/7a4b21250bf79eef26543d35bd390448646c536b - () https://git.kernel.org/stable/c/7a4b21250bf79eef26543d35bd390448646c536b - Patch
References () https://git.kernel.org/stable/c/ca1f06e72dec41ae4f76e7b1a8a97265447b46ae - () https://git.kernel.org/stable/c/ca1f06e72dec41ae4f76e7b1a8a97265447b46ae - Patch
References () https://git.kernel.org/stable/c/d0e214acc59145ce25113f617311aa79dda39cb3 - () https://git.kernel.org/stable/c/d0e214acc59145ce25113f617311aa79dda39cb3 - Patch
References () https://git.kernel.org/stable/c/f06899582ccee09bd85d0696290e3eaca9aa042d - () https://git.kernel.org/stable/c/f06899582ccee09bd85d0696290e3eaca9aa042d - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-119
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: corrige la verificación de desbordamiento del mapa de pila en arcos de 32 bits. El código del mapa de pila se basa en roundup_pow_of_two() para calcular el número de depósitos de hash y contiene una verificación de desbordamiento verificando si el valor resultante es 0. Sin embargo, en arcos de 32 bits, el código de resumen en sí puede desbordarse al realizar un desplazamiento hacia la izquierda de 32 bits de un valor largo sin signo, lo cual es un comportamiento indefinido, por lo que no se garantiza que se trunque claramente. Esto fue activado por syzbot en el tipo DEVMAP_HASH, que contiene la misma verificación, copiada del código hashtab. La confirmación en la etiqueta de correcciones en realidad intentó solucionar este problema, pero la corrección no tuvo en cuenta la UB, por lo que la corrección solo funciona en CPU donde un desbordamiento resulta en un truncamiento claro a cero, lo cual no está garantizado. Verificar el valor antes de redondear no tiene este problema.

17 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 11:15

Updated : 2024-06-27 12:15

NVD link : CVE-2024-26883

Mitre link : CVE-2024-26883

CVE.ORG link : CVE-2024-26883

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer