CVE-2024-26884
Linux Kernel: BPF Hashtab Overflow Bytestar
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup.
INFO
Published Date :
April 17, 2024, 11:15 a.m.
Last Modified :
June 27, 2024, 12:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26884.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26884 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26884 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Apr. 29, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 No Types Assigned https://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 Patch Changed Reference Type https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d No Types Assigned https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d Patch Changed Reference Type https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 No Types Assigned https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 Patch Changed Reference Type https://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1 No Types Assigned https://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1 Patch Changed Reference Type https://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 No Types Assigned https://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 Patch Changed Reference Type https://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace No Types Assigned https://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace Patch Changed Reference Type https://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 No Types Assigned https://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 Patch Changed Reference Type https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 No Types Assigned https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 Patch Changed Reference Type https://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e No Types Assigned https://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e Patch Added CWE NIST CWE-119 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.19 up to (excluding) 4.19.311 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.273 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.214 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.153 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.83 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.23 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.11 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.8 up to (excluding) 6.8.2 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 17, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup. Added Reference kernel.org https://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26884 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26884
weaknesses.