CVE-2024-50163
Linux Kernel - BPF Bypass Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger. With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.
INFO
Published Date :
Nov. 7, 2024, 10:15 a.m.
Last Modified :
Nov. 22, 2024, 5:34 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-50163.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-50163 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-50163 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 22, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.14 up to (excluding) 5.15.170 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.115 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.59 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.6 *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* Changed Reference Type https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16 No Types Assigned https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16 Patch Changed Reference Type https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3 No Types Assigned https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3 Patch Changed Reference Type https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466 No Types Assigned https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466 Patch Changed Reference Type https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962 No Types Assigned https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962 Patch Changed Reference Type https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826 No Types Assigned https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826 Patch -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 07, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger. With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake. Added Reference kernel.org https://git.kernel.org/stable/c/4e1e428533845d48828bd3875c0e92e8565b9962 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/314dbee9fe4f5cee36435465de52c988d7caa466 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/0fca5ed4be8e8bfbfb9bd97845af596bab7192d3 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/cec288e05ceac9a0d3a3a1fd279534b11844c826 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/09d88791c7cd888d5195c84733caf9183dcfbd16 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-50163 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-50163
weaknesses.