CVE-2022-50168

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: fix freeing of not-finalized bpf_prog_pack

syzbot reported a few issues with bpf_prog_pack [1], [2]. This only happens with multiple subprogs. In jit_subprogs(), we first call bpf_int_jit_compile() on each sub program. And then, we call it on each sub program again. jit_data is not freed in the first call of bpf_int_jit_compile(). Similarly we don't call bpf_jit_binary_pack_finalize() in the first call of bpf_int_jit_compile().

If bpf_int_jit_compile() failed for one sub program, we will call bpf_jit_binary_pack_finalize() for this sub program. However, we don't have a chance to call it for other sub programs. Then we will hit "goto out_free" in jit_subprogs(), and call bpf_jit_free on some subprograms that haven't got bpf_jit_binary_pack_finalize() yet.

At this point, bpf_jit_binary_pack_free() is called and the whole 2MB page is freed erroneously.

Fix this with a custom bpf_jit_free() for x86_64, which calls bpf_jit_binary_pack_finalize() if necessary. Also, with custom bpf_jit_free(), bpf_prog_aux->use_bpf_prog_pack is not needed any more, remove it.

[1] https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f [2] https://syzkaller.appspot.com/bug?extid=87f65c75f4a72db05445

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access with elevated privileges to load extended Berkeley Packet Filter (eBPF) programs containing multiple subprograms, and the resulting blast radius is limited to a system crash. On typical Red Hat deployments, unprivileged eBPF execution is restricted by default, meaning an attacker must already hold administrative privileges such as CAP_BPF or CAP_SYS_ADMIN to interact with the JIT compilation subsystem. Although improper memory deallocation during compilation failure can destabilize kernel memory, it cannot be leveraged directly by unprivileged local users or remotely across the network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.