CVE-2024-49861

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix helper writes to read-only maps

Lonial found an issue that despite user- and BPF-side frozen BPF map

(like in case of .rodata), it was still possible to write into it from

a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}

as arguments.

In check_func_arg() when the argument is as mentioned, the meta->raw_mode

is never set. Later, check_helper_mem_access(), under the case of

PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the

subsequent call to check_map_access_type() and given the BPF map is

read-only it succeeds.

The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT

when results are written into them as opposed to read out of them. The

latter indicates that it's okay to pass a pointer to uninitialized memory

as the memory is written to anyway.

However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM

just with additional al

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References