CVE-2024-47702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fail verification for sign-extension of packet data/data_end/data_meta

syzbot reported a kernel crash due to

commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses").

The reason is due to sign-extension of 32-bit load for

packet data/data_end/data_meta uapi field.

The original code looks like:

r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */

r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */

r0 = r2

r0 += 8

if r3 > r0 goto +1

...

Note that __sk_buff->data load has 32-bit sign extension.

After verification and convert_ctx_accesses(), the final asm code looks like:

r2 = *(u64 *)(r1 +208)

r2 = (s32)r2

r3 = *(u64 *)(r1 +80)

r0 = r2

r0 += 8

if r3 > r0 goto pc+1

...

Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid

which may cause runtime failure.

Currently, in C cod

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References