CVE-2024-56615

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix OOB devmap writes when deleting elements

Jordy reported issue against XSKMAP which also applies to DEVMAP - the

index used for accessing map entry, due to being a signed integer,

causes the OOB writes. Fix is simple as changing the type from int to

u32, however, when compared to XSKMAP case, one more thing needs to be

addressed.

When map is released from system via dev_map_free(), we iterate through

all of the entries and an iterator variable is also an int, which

implies OOB accesses. Again, change it to be u32.

Example splat below:

[ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000

[ 160.731662] #PF: supervisor read access in kernel mode

[ 160.736876] #PF: error_code(0x0000) - not-present page

[ 160.742095] PGD 0 P4D 0

[ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP

[ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487

[ 160.757050] Hard

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References