CVE-2024-56614

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix OOB map writes when deleting elements

Jordy says:

"

In the xsk_map_delete_elem function an unsigned integer

(map->max_entries) is compared with a user-controlled signed integer

(k). Due to implicit type conversion, a large unsigned value for

map->max_entries can bypass the intended bounds check:

if (k >= map->max_entries)

return -EINVAL;

This allows k to hold a negative value (between -2147483648 and -2),

which is then used as an array index in m->xsk_map[k], which results

in an out-of-bounds access.

spin_lock_bh(&m->lock);

map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry

old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write

if (old_xs)

xsk_map_sock_delete(old_xs, map_entry);

spin_unlock_bh(&m->lock);

The xchg operation can then be used to cause an out-of-bounds write.

Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead

to further memory corruption.

"

It indeed

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References