CVE-2024-42072

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix may_goto with negative offset.

Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto. The 1st bug is the way may_goto is patched. When offset is negative it should be patched differently. The 2nd bug is in the verifier: when current state may_goto_depth is equal to visited state may_goto_depth it means there is an actual infinite loop. It's not correct to prune exploration of the program at this point. Note, that this check doesn't limit the program to only one may_goto insn, since 2nd and any further may_goto will increment may_goto_depth only in the queued state pushed for future exploration. The current state will have may_goto_depth == 0 regardless of number of may_goto insns and the verifier has to explore the program until bpf_exit.

A low impact flaw was found in the Linux kernel BPF subsystem. The may_goto BPF instruction was patched incorrectly when its offset was negative, and the BPF verifier incorrectly pruned the exploration of a loaded program when the current and previously visited states had equal may_goto_depth, which in fact means the program contains an actual infinite loop that the verifier should reject. A local attacker able to load a specially crafted BPF program could therefore have a program containing an infinite loop accepted by the verifier and executed, causing a denial of service (kernel CPU consumption or hang). Red Hat rates this issue as low impact with moderate CVSS severity (5.2, CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) because exploitation requires the ability to load crafted BPF programs and the publicly generated triggering program does not constitute a complete proof-of-concept, resulting in high attack complexity and privileges required with low confidentiality and integrity impact. This differs from the NIST and CVE.org severity of 7.8 (Important), which assumes low attack complexity and privileges and high confidentiality and integrity impact. The vulnerable may_goto instruction support was introduced in upstream Linux 6.9 and is not present in the Red Hat Enterprise Linux 6, 8, and 9 kernel and kernel-rt packages, so those Red Hat Enterprise Linux products and the Hosted OpenShift Clusters (OSD and ARO) are not affected; Red Hat Enterprise Linux 7 Extended Lifecycle Support is out of support scope. The Fedora community project is affected, and a fix is being pursued by the Fedora community.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.