CVE-2024-50162

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: devmap: provide rxq after redirect

rxq contains a pointer to the device from where

the redirect happened. Currently, the BPF program

that was executed after a redirect via BPF_MAP_TYPE_DEVMAP*

does not have it set.

This is particularly bad since accessing ingress_ifindex, e.g.

SEC("xdp")

int prog(struct xdp_md *pkt)

{

return bpf_redirect_map(&dev_redirect_map, 0, 0);

}

SEC("xdp/devmap")

int prog_after_redirect(struct xdp_md *pkt)

{

bpf_printk("ifindex %i", pkt->ingress_ifindex);

return XDP_PASS;

}

depends on access to rxq, so a NULL pointer gets dereferenced:

<1>[ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000

<1>[ 574.475188] #PF: supervisor read access in kernel mode

<1>[ 574.475194] #PF: error_code(0x0000) - not-present page

<6>[ 574.475199] PGD 0 P4D 0

<4>[ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI

<4>[ 574.475217] CPU: 4 UID: 0 PID: 2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References