CVE-2024-35917

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/bpf: Fix bpf_plt pointer arithmetic

Kui-Feng Lee reported a crash on s390x triggered by the

dummy_st_ops/dummy_init_ptr_arg test [1]:

[<0000000000000002>] 0x2

[<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250

[<000000000033145a>] __sys_bpf+0xa1a/0xd00

[<00000000003319dc>] __s390x_sys_bpf+0x44/0x50

[<0000000000c4382c>] __do_syscall+0x244/0x300

[<0000000000c59a40>] system_call+0x70/0x98

This is caused by GCC moving memcpy() after assignments in

bpf_jit_plt(), resulting in NULL pointers being written instead of

the return and the target addresses.

Looking at the GCC internals, the reordering is allowed because the

alias analysis thinks that the memcpy() destination and the assignments'

left-hand-sides are based on different objects: new_plt and

bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot

alias.

This is in turn due to a violation of the C standard:

When two pointers a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References