CVE-2024-50164

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix overloading of MEM_UNINIT's meaning

Lonial reported an issue in the BPF verifier where check_mem_size_reg()

has the following code:

if (!tnum_is_const(reg->var_off))

/* For unprivileged variable accesses, disable raw

* mode so that the program is required to

* initialize all the memory that the helper could

* just partially fill up.

*/

meta = NULL;

This means that writes are not checked when the register containing the

size of the passed buffer has not a fixed size. Through this bug, a BPF

program can write to a map which is marked as read-only, for example,

.rodata global maps.

The problem is that MEM_UNINIT's initial meaning that "the passed buffer

to the BPF helper does not need to be initialized" which was added back

in commit 435faee1aae9 ("bpf, verifier: add ARG_PTR_TO_RAW_STACK type")

got overloaded over time with "the passed buffer is being

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References