Re: CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

Re: CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

[Shung-Hsi Yu]

On Wed, Jun 19, 2024 at 03:36:13PM GMT, Greg Kroah-Hartman wrote:
> In the Linux kernel, the following vulnerability has been resolved:
> 
> bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
> 
> bpf_prog_attach uses attach_type_to_prog_type to enforce proper
> attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses
> bpf_prog_get and relies on bpf_prog_attach_check_attach_type
> to properly verify prog_type <> attach_type association.
> 
> Add missing attach_type enforcement for the link_create case.
> Otherwise, it's currently possible to attach cgroup_skb prog
> types to other cgroup hooks.
> 
> The Linux kernel CVE team has assigned CVE-2024-38564 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.6.33 with commit 6675c541f540
> 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.8.12 with commit 67929e973f5a
> 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.9.3 with commit b34bbc766510
> 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.10-rc1 with commit 543576ec15b1

I'd like to dispute the affected commit for this CVE.

The commit that introduced the issue should instead be commit
4a1e7c0c63e02 ("bpf: Support attaching freplace programs to multiple
attach points") in 5.10.

When link_create() was added in commit af6eea57437a, it uses
bpf_prog_get_type(attr->link_create.prog_fd, ptype) to resolve struct
bpf_prog, which effectively does the requried

	prog->type == attach_type_to_prog_type(attach_type)

check through bpf_prog_get_ok(), and thus would not allow
BPF_PROG_TYPE_CGROUP_SKB to be attached to other cgroup hooks.

It is in commit 4a1e7c0c63e02 ("bpf: Support attaching freplace programs
to multiple attach points") that had bpf_prog_get_type() replaced with
bpf_prog_get() and lead to the removal of such check, making it possible
to attach BPF_PROG_TYPE_CGROUP_SKB to other cgroup hooks.

[...]

Re: CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

[Greg Kroah-Hartman]

On Wed, Jun 26, 2024 at 02:44:31PM +0800, Shung-Hsi Yu wrote:
> On Wed, Jun 19, 2024 at 03:36:13PM GMT, Greg Kroah-Hartman wrote:
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
> > 
> > bpf_prog_attach uses attach_type_to_prog_type to enforce proper
> > attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses
> > bpf_prog_get and relies on bpf_prog_attach_check_attach_type
> > to properly verify prog_type <> attach_type association.
> > 
> > Add missing attach_type enforcement for the link_create case.
> > Otherwise, it's currently possible to attach cgroup_skb prog
> > types to other cgroup hooks.
> > 
> > The Linux kernel CVE team has assigned CVE-2024-38564 to this issue.
> > 
> > 
> > Affected and fixed versions
> > ===========================
> > 
> > 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.6.33 with commit 6675c541f540
> > 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.8.12 with commit 67929e973f5a
> > 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.9.3 with commit b34bbc766510
> > 	Issue introduced in 5.7 with commit af6eea57437a and fixed in 6.10-rc1 with commit 543576ec15b1
> 
> I'd like to dispute the affected commit for this CVE.
> 
> The commit that introduced the issue should instead be commit
> 4a1e7c0c63e02 ("bpf: Support attaching freplace programs to multiple
> attach points") in 5.10.
> 
> When link_create() was added in commit af6eea57437a, it uses
> bpf_prog_get_type(attr->link_create.prog_fd, ptype) to resolve struct
> bpf_prog, which effectively does the requried
> 
> 	prog->type == attach_type_to_prog_type(attach_type)
> 
> check through bpf_prog_get_ok(), and thus would not allow
> BPF_PROG_TYPE_CGROUP_SKB to be attached to other cgroup hooks.
> 
> It is in commit 4a1e7c0c63e02 ("bpf: Support attaching freplace programs
> to multiple attach points") that had bpf_prog_get_type() replaced with
> bpf_prog_get() and lead to the removal of such check, making it possible
> to attach BPF_PROG_TYPE_CGROUP_SKB to other cgroup hooks.
> 
> [...]

Thanks for the information, we have now adjusted the vulnerable commit
and pushed out the new json information to cve.org

greg k-h