CVE-2024-35860

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: support deferring bpf_link dealloc to after RCU grace period

BPF link for some program types is passed as a "context" which can be

used by those BPF programs to look up additional information. E.g., for

multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values.

Because of this runtime dependency, when bpf_link refcnt drops to zero

there could still be active BPF programs running accessing link data.

This patch adds generic support to defer bpf_link dealloc callback to

after RCU GP, if requested. This is done by exposing two different

deallocation callbacks, one synchronous and one deferred. If deferred

one is provided, bpf_link_free() will schedule dealloc_deferred()

callback to happen after RCU GP.

BPF is using two flavors of RCU: "classic" non-sleepable one and RCU

tasks trace one. The latter is used when sleepable BPF programs are

used. bpf_link_free() accommodates that by checking underlyin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References