From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63DD11FCC52 for ; Mon, 21 Oct 2024 19:41:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729539709; cv=none; b=jrMHKmYrDUuV59LhtWtSS8tLTuH14sUUqLbfk88cCW3HD6KCPtDYzhNw3MH+y+tO8Rb9MsCKHTAUn6mhrGUGn4s2Hx2IxCD32O0N7NZW/us6c65HQxGKCFeWLtpdvrpbzxvhJvV2+aRS/O9M7WonY4mrqvePvXFz8nLz7PkmnXM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729539709; c=relaxed/simple; bh=BPHYCVr0NUeL6YLAbcGZaQyXYqVF3Pe4o0jtyQVCYG8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rz+rO5d9FQkOqYHkPPydXOo53YH05fCFJ7YDNisQcrWKhrFP9vLM+AtBQaKS0IEe0OF6nwymbSRcp2Kf2tI8Vdsf6UBomDGc33mYu0D3FDpdJWfZuSkYcWAvgT5pSTRUkjYwzJXqcgZl6FM89BvwaJH0c+b7fBrdXvn1s3V6mSY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PICGOS2L; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PICGOS2L" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D267FC4CEC3; Mon, 21 Oct 2024 19:41:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1729539709; bh=BPHYCVr0NUeL6YLAbcGZaQyXYqVF3Pe4o0jtyQVCYG8=; h=From:To:Cc:Subject:Date:Reply-to:From; b=PICGOS2Lj5FRVkFix5lD3UhMgqYG//b0EBNb/Y1I1TzLpzjEYycu0jnkPgBpN1hwS bN/5CghOaqsPJR4ChB+TaL4ycQN24NGlJn+v4tAskwgi3japgd4Urbp/xoJ5PJcDtJ oQraCDoFO5mANdMSyx78SzsEIj2GdUNKK4UMrmXI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-50063: bpf: Prevent tail call between progs attached to different hooks Date: Mon, 21 Oct 2024 21:40:04 +0200 Message-ID: <2024102136-CVE-2024-50063-1a59@gregkh> X-Mailer: git-send-email 2.47.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3327; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=BPHYCVr0NUeL6YLAbcGZaQyXYqVF3Pe4o0jtyQVCYG8=; b=owGbwMvMwCRo6H6F97bub03G02pJDOlia3+8150j8Ph/j0B2xeYVgvW7uM5z63y96dN+MbXUc n3AgdqKjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIoWaG+VlNB3qO2Ey2s2r+ xsCxW9fvsJ5uGsNcKd19rGrdZ2/uevBl55l6MxNxVtObAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed. For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it. The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed. Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security. That is, the return value rule is bypassed. This patch adds restriction for tail call to prevent such bypasses. The Linux kernel CVE team has assigned CVE-2024-50063 to this issue. Affected and fixed versions =========================== Fixed in 6.6.57 with commit 5d5e3b4cbe8e Fixed in 6.11.4 with commit 88c2a10e6c17 Fixed in 6.12-rc1 with commit 28ead3eaabc1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-50063 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/bpf.h kernel/bpf/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1 https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1 https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356