CVE-2024-26589

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off

for validation. However, variable offset ptr alu is not prohibited

for this ptr kind. So the variable offset is not checked.

The following prog is accepted:

func#0 @0

0: R1=ctx() R10=fp0

0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx()

1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys()

2: (b7) r8 = 1024 ; R8_w=1024

3: (37) r8 /= 1 ; R8_w=scalar()

4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,

smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))

5: (0f) r7 += r8

mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1

mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024

mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1

mark_precise: frame0: regs=r8 stack= before 2:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References