CVE-2024-50253: bpf: Check the validity of nr_words in bpf_iter_bits_new()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check the validity of nrwords in bpfiterbitsnew()
Check the validity of nrwords in bpfiterbitsnew(). Without this check, when multiplication overflow occurs for nrbits (e.g., when nrwords = 0x0400-0001, nrbits becomes 64), stack corruption may occur due to bpfprobereadkernelcommon(..., nrbytes = 0x2000-0008).
Fix it by limiting the maximum value of nrwords to 511. The value is derived from the current implementation of BPF memory allocator. To ensure compatibility if the BPF memory allocator's size limitation changes in the future, use the helper bpfmemallocchecksize() to check whether nrbytes is too larger. And return -E2BIG instead of -ENOMEM for oversized nrbytes.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
Modify/ensure bpf_iter_bits_new() limits the maximum value of nr_words to 511.
Linux kernel BPF (bpf_iter_bits_new) Validate nr_words = limit maximum nr_words to 511 - Configuration
Use the helper bpf_mem_alloc_check_size() to check whether nr_bytes is too large (for compatibility with future BPF memory allocator size limitation changes).
Linux kernel BPF (nr_bytes sizing) nr_bytes too large check = use bpf_mem_alloc_check_size() - Configuration
Ensure bpf_iter_bits_new()/related logic returns -E2BIG (not -ENOMEM) when nr_bytes is oversized.
Linux kernel BPF (error handling) return code on oversized nr_bytes = -E2BIG instead of -ENOMEM
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50253?
CVE-2024-50253 is categorized with a medium severity level due to its potential impact on system stability.
How do I fix CVE-2024-50253?
To remediate CVE-2024-50253, update the Linux kernel to version 6.11.7 or later.
What versions of Linux are affected by CVE-2024-50253?
CVE-2024-50253 affects Linux kernel versions from 6.11 to 6.12-rc5.
What kind of vulnerability is CVE-2024-50253?
CVE-2024-50253 is a vulnerability in the BPF that could allow for multiplication overflow without proper checks.
Can CVE-2024-50253 be exploited remotely?
CVE-2024-50253 requires local access for exploitation, making it less of a remote threat.