CVE-2024-58088

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix deadlock when freeing cgroup storage

The following commit

bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]")

first introduced deadlock prevention for fentry/fexit programs attaching

on bpf_task_storage helpers. That commit also employed the logic in map

free path in its v6 version.

Later bpf_cgrp_storage was first introduced in

c4bcfb38a95e ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs")

which faces the same issue as bpf_task_storage, instead of its busy

counter, NULL was passed to bpf_local_storage_map_free() which opened

a window to cause deadlock:

<TASK>

(acquiring local_storage->lock)

_raw_spin_lock_irqsave+0x3d/0x50

bpf_local_storage_update+0xd1/0x460

bpf_cgrp_storage_get+0x109/0x130

bpf_prog_a4d4a370ba857314_cgrp_ptr+0x139/0x170

? __bpf_prog_enter_recur+0x16/0x80

bpf_trampoline_6442485186+0x43/0xa4

cgroup_storage_ptr+0x9/0x20

(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References