CVE-2024-42082: xdp: Remove WARN() from __xdp_reg_mem_model()
In the Linux kernel, the following vulnerability has been resolved:
xdp: Remove WARN() from xdpregmemmodel()
syzkaller reports a warning in xdpregmemmodel().
The warning occurs only if memidinithashtable() returns an error. It returns the error in two cases:
1. memory allocation fails; 2. rhashtableinit() fails when some fields of rhashtableparams struct are not initialized properly.
The second case cannot happen since there is a static const rhashtableparams struct with valid fields. So, warning is only triggered when there is a problem with memory allocation.
Thus, there is no sense in using WARN() to handle this error and it can be safely removed.
WARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 xdpregmemmodel+0x2d9/0x650 net/core/xdp.c:299
CPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:xdpregmemmodel+0x2d9/0x650 net/core/xdp.c:299
Call Trace: xdpregmemmodel+0x22/0x40 net/core/xdp.c:344 xdptestrunsetup net/bpf/testrun.c:188 [inline] bpftestrunxdplive+0x365/0x1e90 net/bpf/testrun.c:377 bpfprogtestrunxdp+0x813/0x11b0 net/bpf/testrun.c:1267 bpfprogtestrun+0x33a/0x3b0 kernel/bpf/syscall.c:4240 sysbpf+0x48d/0x810 kernel/bpf/syscall.c:5649 dosysbpf kernel/bpf/syscall.c:5738 [inline] sesysbpf kernel/bpf/syscall.c:5736 [inline] x64sysbpf+0x7c/0x90 kernel/bpf/syscall.c:5736 dosyscall64+0xfb/0x240 entrySYSCALL64afterhwframe+0x6d/0x75
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42082?
The severity of CVE-2024-42082 is considered moderate due to the warning generated in the Linux kernel when certain conditions are met.
How do I fix CVE-2024-42082?
To fix CVE-2024-42082, upgrade your Linux kernel to one of the patched versions including 5.10.221, 5.15.162, 6.1.97, 6.6.37, or later.
Which Linux kernel versions are affected by CVE-2024-42082?
CVE-2024-42082 affects Linux kernel versions from 4.18 up to but not including 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.97, and 6.2 to 6.6.37.
Is CVE-2024-42082 limited to any specific Linux distributions?
CVE-2024-42082 is reported on both Red Hat and Debian-based distributions with specific kernel versions affected.
What is the impact of CVE-2024-42082 on system performance?
The impact of CVE-2024-42082 is limited to the generation of warnings in the log, which may not affect overall system performance significantly.