CVE-2024-35895

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Prevent lock inversion deadlock in map delete elem

syzkaller started using corpuses where a BPF tracing program deletes

elements from a sockmap/sockhash map. Because BPF tracing programs can be

invoked from any interrupt context, locks taken during a map_delete_elem

operation must be hardirq-safe. Otherwise a deadlock due to lock inversion

is possible, as reported by lockdep:

CPU0 CPU1

---- ----

lock(&htab->buckets[i].lock);

local_irq_disable();

lock(&host->lock);

lock(&htab->buckets[i].lock);

<Interrupt>

lock(&host->lock);

Locks in sockmap are hardirq-unsafe by design. We expects elements to be

deleted from sockmap/sockhash only in task (normal) context with interrupts

enabled, or in softirq context.

Detect when map_delete_elem operation is invoked

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References