CVE-2024-50063

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Prevent tail call between progs attached to different hooks

bpf progs can be attached to kernel functions, and the attached functions

can take different parameters or return different return values. If

prog attached to one kernel function tail calls prog attached to another

kernel function, the ctx access or return value verification could be

bypassed.

For example, if prog1 is attached to func1 which takes only 1 parameter

and prog2 is attached to func2 which takes two parameters. Since verifier

assumes the bpf ctx passed to prog2 is constructed based on func2's

prototype, verifier allows prog2 to access the second parameter from

the bpf ctx passed to it. The problem is that verifier does not prevent

prog1 from passing its bpf ctx to prog2 via tail call. In this case,

the bpf ctx passed to prog2 is constructed from func1 instead of func2,

that is, the assumption for ctx access verification is bypassed.

Another

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References