CVE-2024-26737

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

The following race is possible between bpf_timer_cancel_and_free

and bpf_timer_cancel. It will lead a UAF on the timer->timer.

bpf_timer_cancel();

spin_lock();

t = timer->time;

spin_unlock();

bpf_timer_cancel_and_free();

spin_lock();

t = timer->timer;

timer->timer = NULL;

spin_unlock();

hrtimer_cancel(&t->timer);

kfree(t);

/* UAF on t */

hrtimer_cancel(&t->timer);

In bpf_timer_cancel_and_free, this patch frees the timer->timer

after a rcu grace period. This requires a rcu_head addition

to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init,

this does not need a kfree_rcu because it is still under the

spin_lock and timer->timer has not been visible by others yet.

In bpf_timer_cancel, rcu_read_lock() is added because this helper

can be used in a non rcu critical section context (e.g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References