CVE-2024-50161 Information

Description

In the Linux kernel the following vulnerability has been resolved:

bpf: Check the remaining info_cnt before repeating btf fields

When trying to repeat the btf fields for array of nested struct it doesn’t check the remaining info_cnt. The following splat will be reported when the value of ret nelems is greater than BTF_FIELDS_MAX:

————[ cut here ]———— UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49 index 11 is out of range for type ‘btf_field_info [11]’ CPU: 6 UID: 0 PID: 411 Comm: test_progs …… 6.11.0-rc4+ 1 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX 1996) BIOS … Call Trace: dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_out_of_bounds+0x6f/0x80 ? kallsyms_lookup_name+0x48/0xb0 btf_parse_fields+0x992/0xce0 map_create+0x591/0x770 __sys_bpf+0x229/0x2410 __x64_sys_bpf+0x1f/0x30 x64_sys_call+0x199/0x9f0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fea56f2cc5d …… —[ end trace ]—

Fix it by checking the remaining info_cnt in btf_repeat_fields() before repeating the btf fields.

Reference

https://git.kernel.org/stable/c/6f957d972feee9b385ea3ae6530310a84e55ba71 https://git.kernel.org/stable/c/797d73ee232dd1833dec4824bc53a22032e97c1c