CVE-2024-43910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses

Currently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to

a global function as an argument. The adverse effects of this is that

BPF helpers can continue to make use of this modified

CONST_PTR_TO_DYNPTR from within the context of the global function,

which can unintentionally result in out-of-bounds memory accesses and

therefore compromise overall system stability i.e.

[ 244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140

[ 244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302

[ 244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b586715063 #533

[ 244.174318] Call Trace:

[ 244.175787] <TASK>

[ 244.177356] dump_stack_lvl+0x66/0xa0

[ 244.179531] print_report+0xce/0x670

[ 244.182314] ? __virt_addr_valid+0x200/0x3e0

[ 244.184908] kasan_report+0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References