CVE-2024-58098

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: track changes_pkt_data property for global functions

When processing calls to certain helpers, verifier invalidates all

packet pointers in a current state. For example, consider the

following program:

__attribute__((__noinline__))

long skb_pull_data(struct __sk_buff *sk, __u32 len)

{

return bpf_skb_pull_data(sk, len);

}

SEC("tc")

int test_invalidate_checks(struct __sk_buff *sk)

{

int *p = (void *)(long)sk->data;

if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP;

skb_pull_data(sk, 0);

*p = 42;

return TCX_PASS;

}

After a call to bpf_skb_pull_data() the pointer 'p' can't be used

safely. See function filter.c:bpf_helper_changes_pkt_data() for a list

of such helpers.

At the moment verifier invalidates packet pointers when processing

helper function calls, and does not traverse global sub-programs when

processing calls

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References