CVE-2024-36937

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xdp: use flags field to disambiguate broadcast redirect

When redirecting a packet using XDP, the bpf_redirect_map() helper will set

up the redirect destination information in struct bpf_redirect_info (using

the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect()

function will read this information after the XDP program returns and pass

the frame on to the right redirect destination.

When using the BPF_F_BROADCAST flag to do multicast redirect to a whole

map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct

bpf_redirect_info to point to the destination map to be broadcast. And

xdp_do_redirect() reacts to the value of this map pointer to decide whether

it's dealing with a broadcast or a single-value redirect. However, if the

destination map is being destroyed before xdp_do_redirect() is called, the

map pointer will be cleared out (by bpf_clear_redirect_map()) without

waiting for any XDP progr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References