CVE-2024-50161

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the remaining info_cnt before repeating btf fields

When trying to repeat the btf fields for array of nested struct, it

doesn't check the remaining info_cnt. The following splat will be

reported when the value of ret * nelems is greater than BTF_FIELDS_MAX:

------------[ cut here ]------------

UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49

index 11 is out of range for type 'btf_field_info [11]'

CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1

Tainted: [O]=OOT_MODULE

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...

Call Trace:

<TASK>

dump_stack_lvl+0x57/0x70

dump_stack+0x10/0x20

ubsan_epilogue+0x9/0x40

__ubsan_handle_out_of_bounds+0x6f/0x80

? kallsyms_lookup_name+0x48/0xb0

btf_parse_fields+0x992/0xce0

map_create+0x591/0x770

__sys_bpf+0x229/0x2410

__x64_sys_bpf+0x1f/0x30

x64_sys_call+0x199/0x9f0

do_syscall_64+0x3b/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References