Skip to content
Heist/ feed
High

bpf: Fail verification for sign-extension of packet data/data_end/data_meta

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/data_end/data_meta syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r

Announced Source revision 1
Original source ↗

CVE-2024-47702

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-47702

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "1f1e864b65554e33fe74e3377e58b12f4302f2eb",
        "lessThan": "4b48228eebce2ab1b01e3133da822164472b7e46",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1f1e864b65554e33fe74e3377e58b12f4302f2eb",
        "lessThan": "f1620c93a1ec950d87ef327a565d3907736d3340",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1f1e864b65554e33fe74e3377e58b12f4302f2eb",
        "lessThan": "f09757fe97a225ae505886eac572e4cbfba96537",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1f1e864b65554e33fe74e3377e58b12f4302f2eb",
        "lessThan": "92de36080c93296ef9005690705cba260b9bd68a",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/linux/bpf.h",
      "kernel/bpf/verifier.c",
      "net/core/filter.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.6"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.6",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.10.13",
        "versionType": "semver",
        "lessThanOrEqual": "6.10.*"
      },
      {
        "status": "unaffected",
        "version": "6.11.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.11.*"
      },
      {
        "status": "unaffected",
        "version": "6.12",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/linux/bpf.h",
      "kernel/bpf/verifier.c",
      "net/core/filter.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-47702

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#8234 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement