CVE-2024-26591: bpf: Fix re-attachment branch in bpf_tracing_prog_attach
bpf: Fix re-attachment branch in bpftracingprogattach
The following case can cause a crash due to missing attachbtf:
1) load rawtp program 2) load fentry program with rawtp as targetfd 3) create tracing link for fentry program with targetfd = 0 4) repeat 3
In the end we have:
- prog->aux->dsttrampoline == NULL - tgtprog == NULL (because we did not provide targetfd to linkcreate) - prog->aux->attachbtf == NULL (the program was loaded with attachprogfd=X) - the program was loaded for tgtprog but we have no way to find out which one
BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? die+0x20/0x70 ? pagefaultoops+0x15b/0x430 ? fixupexception+0x22/0x330 ? excpagefault+0x6f/0x170 ? asmexcpagefault+0x22/0x30 ? bpftracingprogattach+0x279/0x560 ? btfobjid+0x5/0x10 bpftracingprogattach+0x439/0x560 sysbpf+0x1cf4/0x2de0 x64sysbpf+0x1c/0x30 dosyscall64+0x41/0xf0 entrySYSCALL64afterhwframe+0x6e/0x76
Return -EINVAL in this situation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch bpf: Fix re-attachment branch in bpf_tracing_prog_attach - Configuration
Apply the fix so that, when bpf_tracing_prog_attach encounters the situation where prog->aux->attach_btf == NULL (e.g., re-attachment after linking fentry with rawtp and target_fd=0), it returns -EINVAL instead of dereferencing NULL and crashing.
Linux kernel BPF tracing (bpf_tracing_prog_attach) Return value when attach_btf is missing = -EINVAL
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26591?
CVE-2024-26591 has been classified with a high severity due to its potential to cause a crash in affected Linux kernel versions.
How do I fix CVE-2024-26591?
To fix CVE-2024-26591, upgrade to Linux kernel versions 5.10.223-1, 6.1.123-1, or later patched versions that address this vulnerability.
Which versions of Linux Kernel are affected by CVE-2024-26591?
CVE-2024-26591 affects Linux kernel versions from 5.16.0 to 6.1.75 and 6.2.0 to 6.6.14, as well as specific versions in the 6.7.x range.
What actions lead to the crash related to CVE-2024-26591?
The crash related to CVE-2024-26591 can occur when manipulating tracing links with invalid target file descriptors in specific BPF program attachments.
Is there a specific patch for CVE-2024-26591?
Yes, specific patches have been released for CVE-2024-26591 in versions 5.10.223-1, 6.1.123-1, and 6.12.x series of the Linux kernel.