CVE-2024-43840: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix trampoline for BPFTRAMPFCALLORIG
When BPFTRAMPFCALLORIG is set, the trampoline calls bpftrampenter() and bpftrampexit() functions, passing them the struct bpftrampimage im pointer as an argument in R0.
The trampoline generation code uses emitaddrmovi64() to emit instructions for moving the bpftrampimage address into R0, but emitaddrmovi64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpftrampimage is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to bpftrampenter/exit() causing a kernel crash.
Fix this by using emita64movi64() in place of emitaddrmovi64() as it can work with addresses that are greater than 48-bits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43840?
CVE-2024-43840 has been classified as a medium severity vulnerability affecting the Linux kernel.
What impact does CVE-2024-43840 have on affected systems?
CVE-2024-43840 could potentially allow unauthorized access to sensitive information in systems running vulnerable versions of the Linux kernel.
How do I fix CVE-2024-43840?
To mitigate CVE-2024-43840, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, or 6.12.11-1 or later.
Which Linux kernel versions are affected by CVE-2024-43840?
CVE-2024-43840 affects Linux kernel versions from 6.0 to 6.10.3 and specific versions in the 5.10 and 6.1 series.
Is CVE-2024-43840 present in Debian Linux systems?
Yes, CVE-2024-43840 is present in certain Debian Linux systems running affected kernel versions, and users should apply the recommended updates.