CVE-2024-42063: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode

Published Jul 29, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf prog stack with kmsanunposionmemory in interpreter mode

syzbot reported uninit memory usages during map{lookup,delete}elem.

========== BUG: KMSAN: uninit-value in devmaplookupelem kernel/bpf/devmap.c:441 [inline] BUG: KMSAN: uninit-value in devmaplookupelem+0xf3/0x170 kernel/bpf/devmap.c:796 devmaplookupelem kernel/bpf/devmap.c:441 [inline] devmaplookupelem+0xf3/0x170 kernel/bpf/devmap.c:796 bpfmaplookupelem kernel/bpf/helpers.c:42 [inline] bpfmaplookupelem+0x5c/0x80 kernel/bpf/helpers.c:38 bpfprogrun+0x13fe/0xe0f0 kernel/bpf/core.c:1997 bpfprogrun256+0xb5/0xe0 kernel/bpf/core.c:2237 ==========

The reproducer should be in the interpreter mode.

The C reproducer is trying to run the following bpf prog:

0: (18) r0 = 0x0 2: (18) r1 = map[id:49] 4: (b7) r8 = 16777216 5: (7b) (u64 )(r10 -8) = r8 6: (bf) r2 = r10 7: (07) r2 += -229 ^^^^^^^^^^

8: (b7) r3 = 8 9: (b7) r4 = 0 10: (85) call devmaplookupelem#1543472 11: (95) exit

It is due to the "void key" (r2) passed to the helper. bpf allows uninit stack memory access for bpf prog with the right privileges. This patch uses kmsanunpoisonmemory() to mark the stack as initialized.

This should address different syzbot reports on the uninit "void key" argument during map{lookup,delete}elem.

Affected Software

5 affected componentsFixes available
Linux Linux kernel<6.1.97
Linux Linux kernel>=6.2<6.6.37
Linux Linux kernel>=6.7<6.9.8
debian/linux<=5.10.223-1, <=5.10.234-1
6.1.129-16.1.135-16.12.22-16.12.25-1
debian/linux-6.1
6.1.129-1~deb11u1

Event History

Jul 29, 2024
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
Description
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 19, 2024
Data Sourced
via Ubuntu·12:31 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-42063?

CVE-2024-42063 is classified as a moderate severity vulnerability in the Linux kernel.

2

How do I fix CVE-2024-42063?

To mitigate CVE-2024-42063, upgrade the Linux kernel to versions 6.1.123-1, 6.12.10-1, or later.

3

Which versions of Linux are affected by CVE-2024-42063?

Linux kernel versions up to 6.1.97 and between 6.2 to 6.6.37 are affected by CVE-2024-42063.

4

Is CVE-2024-42063 related to memory issues in the Linux kernel?

Yes, CVE-2024-42063 deals with uninitialized memory usage in the BPF interpreter mode.

5

What specific functionality does CVE-2024-42063 impact?

CVE-2024-42063 impacts the functionality related to map lookup and deletion in the BPF framework of the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203