CVE-2024-50163

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Make sure internal and UAPI bpf_redirect flags don't overlap

The bpf_redirect_info is shared between the SKB and XDP redirect paths,

and the two paths use the same numeric flag values in the ri->flags

field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that

if skb bpf_redirect_neigh() is used with a non-NULL params argument and,

subsequently, an XDP redirect is performed using the same

bpf_redirect_info struct, the XDP path will get confused and end up

crashing, which syzbot managed to trigger.

With the stack-allocated bpf_redirect_info, the structure is no longer

shared between the SKB and XDP paths, so the crash doesn't happen

anymore. However, different code paths using identically-numbered flag

values in the same struct field still seems like a bit of a mess, so

this patch cleans that up by moving the flag definitions together and

redefining the three flags in BPF_F_REDIRECT_INTERNAL to not o

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References