CVE-2024-47702 Information

Description

In the Linux kernel the following vulnerability has been resolved:

bpf: Fail verification for sign-extension of packet data/data_end/data_meta

syzbot reported a kernel crash due to commit 1f1e864b6555 (pf: Handle sign-extenstin ctx member accesses). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field.

The original code looks like: r2 = (s32 )(r1 + 76) / load __sk_buff->data / r3 = (u32 )(r1 + 80) / load __sk_buff->data_end / r0 = r2 r0 += 8 if r3 > r0 goto +1 … Note that __sk_buff->data load has 32-bit sign extension.

After verification and convert_ctx_accesses() the final asm code looks like: r2 = (u64 )(r1 +208) r2 = (s32)r2 r3 = (u64 )(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 … Note that ‘r2 = (s32)r2’ may make the kernel __sk_buff->data address invalid which may cause runtime failure.

Currently in C code typically we have void data = (void )(long)skb->data; void data_end = (void )(long)skb->data_end; … and it will generate r2 = (u64 )(r1 +208) r3 = (u64 )(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1

If we allow sign-extension void data = (void )(long)(int)skb->data; void data_end = (void )(long)skb->data_end; … the generated code looks like r2 = (u64 )(r1 +208) r2 «= 32 r2 s»= 32 r3 = (u64 )(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since 2 «= 32\ is not allowed as 2\ is a packet pointer.

To fix this issue for case r2 = (s32 )(r1 + 76) / load __sk_buff->data / this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion the verification will fail.

[1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://git.kernel.org/stable/c/f1620c93a1ec950d87ef327a565d3907736d3340 https://git.kernel.org/stable/c/f09757fe97a225ae505886eac572e4cbfba96537 https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5