CVE-2024-42063

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode

syzbot reported uninit memory usages during map_{lookup,delete}_elem.

==========

BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]

BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796

__dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]

dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796

____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline]

bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38

___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997

__bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237

==========

The reproducer should be in the interpreter mode.

The C reproducer is trying to run the following bpf prog:

0: (18) r0 = 0x0

2: (18) r1 = map[id:49]

4: (b7) r8 = 16777216

5: (7b) *(u64 *)(r10 -8) = r8

6: (bf) r2 = r10

7: (07) r2 += -229

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References