CVE-2024-50123: bpf: Add the missing BPF_LINK_TYPE invocation for sockmap
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add the missing BPFLINKTYPE invocation for sockmap
There is an out-of-bounds read in bpflinkshowfdinfo() for the sockmap link fd. Fix it by adding the missing BPFLINKTYPE invocation for sockmap link
Also add comments for bpflinktype to prevent missing updates in the future.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
Modify the Linux kernel BPF implementation to add the missing BPF_LINK_TYPE invocation for the sockmap link when handling sockmap link fds in bpf_link_show_fdinfo() to fix the out-of-bounds read.
Linux kernel BPF (bpf_link_show_fdinfo) BPF_LINK_TYPE invocation = Add the missing BPF_LINK_TYPE invocation for sockmap link - Configuration
Add source comments near the bpf_link_type handling noting that missing BPF_LINK_TYPE invocations (e.g., for sockmap link) can cause issues, to help prevent future omissions.
Linux kernel BPF (bpf_link_type handling) Documentation/comments for bpf_link_type = Add comments to prevent missing updates in the future
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50123?
CVE-2024-50123 has a moderate severity level due to the potential for an out-of-bounds read in the Linux kernel.
How do I fix CVE-2024-50123?
To fix CVE-2024-50123, update the Linux kernel to a version that includes the patch for the sockmap link fd issue.
Which versions of the Linux kernel are affected by CVE-2024-50123?
CVE-2024-50123 affects Linux kernel versions from 6.10 up to, but not including, 6.11.6, as well as specific release candidates of 6.12.
What component of the Linux kernel does CVE-2024-50123 impact?
CVE-2024-50123 impacts the BPF subsystem specifically related to sockmap link file descriptors.
Is CVE-2024-50123 a physical or remote vulnerability?
CVE-2024-50123 is considered a remote vulnerability, as it can be exploited through network interfaces.