CVE-2024-50161: bpf: Check the remaining info_cnt before repeating btf fields
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check the remaining infocnt before repeating btf fields
When trying to repeat the btf fields for array of nested struct, it doesn't check the remaining infocnt. The following splat will be reported when the value of ret nelems is greater than BTFFIELDSMAX:
------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49 index 11 is out of range for type 'btffieldinfo [11]' CPU: 6 UID: 0 PID: 411 Comm: testprogs ...... 6.11.0-rc4+ #1 Tainted: [O]=OOTMODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Call Trace: <TASK> dumpstacklvl+0x57/0x70 dumpstack+0x10/0x20 ubsanepilogue+0x9/0x40 ubsanhandleoutofbounds+0x6f/0x80 ? kallsymslookupname+0x48/0xb0 btfparsefields+0x992/0xce0 mapcreate+0x591/0x770 sysbpf+0x229/0x2410 x64sysbpf+0x1f/0x30 x64syscall+0x199/0x9f0 dosyscall64+0x3b/0xc0 entrySYSCALL64afterhwframe+0x4b/0x53 RIP: 0033:0x7fea56f2cc5d ...... </TASK> ---[ end trace ]---
Fix it by checking the remaining infocnt in btfrepeatfields() before repeating the btf fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel bpf/btf.cto a version that resolves this vulnerability.Patch bpf: Check the remaining info_cnt before repeating btf fields
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50161?
CVE-2024-50161 is considered to have a high severity due to potential impact on system stability.
How do I fix CVE-2024-50161?
To fix CVE-2024-50161, you should upgrade to the patched versions of the Linux kernel recommended by your distribution.
What versions of the Linux kernel are affected by CVE-2024-50161?
CVE-2024-50161 affects Linux kernel versions from 6.11.0 up to 6.11.6, as well as 6.12-rc1, 6.12-rc2, and 6.12-rc3.
Is there a workaround for CVE-2024-50161?
There is no known workaround for CVE-2024-50161 other than applying the appropriate kernel updates.
What is the nature of the vulnerability in CVE-2024-50161?
CVE-2024-50161 is a bug in the BPF subsystem that can lead to improper handling of struct fields when processing nested structures.